Make sure that ffmpeg returning us an invalid stream cannot damage us too...

media/filters/ffmpeg_demuxer.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/callback.h"
 #include "base/command_line.h"
 #include "base/message_loop.h"
 #include "base/scoped_ptr.h"
 #include "base/stl_util-inl.h"
 #include "base/string_util.h"
@@ skipping 511 matching lines @@
     StreamHasEnded();
     return;
   }
 
   // Queue the packet with the appropriate stream.
   // TODO(scherkus): should we post this back to the pipeline thread?  I'm
   // worried about downstream filters (i.e., decoders) executing on this
   // thread.
   DCHECK_GE(packet->stream_index, 0);
   DCHECK_LT(packet->stream_index, static_cast<int>(packet_streams_.size()));
-  FFmpegDemuxerStream* demuxer_stream = packet_streams_[packet->stream_index];
+  FFmpegDemuxerStream* demuxer_stream = NULL;
+  size_t i = packet->stream_index;

[fbarchard, 2010/11/08 15:55:47]

Why create a new variable (i)?
FFmpegDemuxerStream* demuxer_stream = NULL;
if (packet->stream_index < packet_streams_.size()) {
  demuxer_stream = packet_streams_[packet->stream_index];
}

+  // Defend against ffmpeg giving us a bad stream index.
+  if (i < packet_streams_.size()) {
+    demuxer_stream = packet_streams_[i];
+  }
   if (demuxer_stream) {
     // Queue the packet with the appropriate stream.  The stream takes
     // ownership of the AVPacket.
     if (packet.get()) {
       // If a packet is returned by FFmpeg's av_parser_parse2()
       // the packet will reference an inner memory of FFmpeg.
       // In this case, the packet's "destruct" member is NULL,
       // and it MUST be duplicated. This fixes issue with MP3 and possibly
       // other codecs.  It is safe to call this function even if the packet does
       // not refer to inner memory from FFmpeg.
@@ skipping 68 matching lines @@
   read_event_.Wait();
   return last_read_bytes_;
 }
 
 void FFmpegDemuxer::SignalReadCompleted(size_t size) {
   last_read_bytes_ = size;
   read_event_.Signal();
 }
 
 }  // namespace media