avformat/rmenc: do not access AVIO write buffer directly

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Marton Balint <cus@passwd.hu>

1 files changed, 8 insertions, 11 deletions

diff --git a/libavformat/rmenc.c b/libavformat/rmenc.c
index f9821d1875..3bff4daf0a 100644
--- a/libavformat/rmenc.c
+++ b/libavformat/rmenc.c
@@ -72,14 +72,12 @@ static int rv10_write_header(AVFormatContext *ctx,
     RMMuxContext *rm = ctx->priv_data;
     AVIOContext *s = ctx->pb;
     StreamInfo *stream;
-    unsigned char *data_offset_ptr, *start_ptr;
     const char *desc, *mimetype;
     int nb_packets, packet_total_size, packet_max_size, size, packet_avg_size, i;
-    int bit_rate, v, duration, flags, data_pos;
+    int bit_rate, v, duration, flags;
+    int data_offset;
     AVDictionaryEntry *tag;
 
-    start_ptr = s->buf_ptr;
-
     ffio_wfourcc(s, ".RMF");
     avio_wb32(s,18); /* header size */
     avio_wb16(s,0);
@@ -119,7 +117,7 @@ static int rv10_write_header(AVFormatContext *ctx,
     avio_wb32(s, BUFFER_DURATION);           /* preroll */
     avio_wb32(s, index_pos);           /* index offset */
     /* computation of data the data offset */
-    data_offset_ptr = s->buf_ptr;
+    data_offset = avio_tell(s);
     avio_wb32(s, 0);           /* data offset : will be patched after */
     avio_wb16(s, ctx->nb_streams);    /* num streams */
     flags = 1 | 2; /* save allowed & perfect play */
@@ -276,12 +274,11 @@ static int rv10_write_header(AVFormatContext *ctx,
     }
 
     /* patch data offset field */
-    data_pos = s->buf_ptr - start_ptr;
-    rm->data_pos = data_pos;
-    data_offset_ptr[0] = data_pos >> 24;
-    data_offset_ptr[1] = data_pos >> 16;
-    data_offset_ptr[2] = data_pos >> 8;
-    data_offset_ptr[3] = data_pos;
+    rm->data_pos = avio_tell(s);
+    if (avio_seek(s, data_offset, SEEK_SET) >= 0) {
+        avio_wb32(s, rm->data_pos);
+        avio_seek(s, rm->data_pos, SEEK_SET);
+    }
 
     /* data stream */
     ffio_wfourcc(s, "DATA");