From 0b1a967b732898e705ea8f2fda5d08eb00328579 Mon Sep 17 00:00:00 2001 From: Carlos Fernandez Sanz Date: Tue, 17 Mar 2026 20:12:20 -0700 Subject: [PATCH] fix: prevent stream detection from corrupting current_file index (#2209) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit detect_stream_type() reads up to 1MB (STARTBYTESLENGTH) via buffered_read_opt() for format detection. For input files smaller than 1MB, the read hits EOF and—because binary_concat defaults to enabled—buffered_read_opt() calls switch_to_next_file(). This increments current_file past the valid range and closes the file descriptor, leaving format-specific handlers (matroska_loop, MP4, etc.) to crash when they access inputfile[current_file]. Fix: temporarily disable binary_concat around detect_stream_type() so that hitting EOF during detection never triggers file switching. Fixes the root cause of the crash reported in PR #2206 (which proposed a band-aid of using current_file-1). Co-authored-by: Claude Opus 4.6 (1M context) --- src/lib_ccx/ccx_demuxer.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/src/lib_ccx/ccx_demuxer.c b/src/lib_ccx/ccx_demuxer.c index f87e9958..ec801f19 100644 --- a/src/lib_ccx/ccx_demuxer.c +++ b/src/lib_ccx/ccx_demuxer.c @@ -136,7 +136,19 @@ static int ccx_demuxer_open(struct ccx_demuxer *ctx, const char *file) if (ctx->auto_stream == CCX_SM_AUTODETECT) { + // Temporarily disable binary_concat during stream detection. + // detect_stream_type reads up to 1MB (STARTBYTESLENGTH) via + // buffered_read_opt. For files smaller than 1MB, hitting EOF + // causes buffered_read_opt to call switch_to_next_file (when + // binary_concat is enabled), which increments current_file + // past the valid range and closes the file descriptor. + // This leaves current_file pointing beyond inputfile[], causing + // format-specific handlers (e.g. matroska_loop) to crash when + // they access inputfile[current_file]. + int saved_binary_concat = ccx_options.binary_concat; + ccx_options.binary_concat = 0; detect_stream_type(ctx); + ccx_options.binary_concat = saved_binary_concat; switch (ctx->stream_mode) { case CCX_SM_ELEMENTARY_OR_NOT_FOUND: