Module: libav Branch: release/0.6 Commit: 23f622de60d66b6e47c28493089566becd635426
Author: Laurent Aimar <[email protected]> Committer: Reinhard Tartler <[email protected]> Date: Sun Sep 11 23:26:12 2011 +0200 oggdec: fix out of bound write in the ogg demuxer Between ogg_save() and ogg_restore() calls, the number of streams could have been reduced. Signed-off-by: Luca Barbato <[email protected]> (cherry picked from commit 0e7efb9d23c3641d50caa288818e8c27647ce74d) Signed-off-by: Anton Khirnov <[email protected]> (cherry picked from commit a3d471e500674c31fa4f52a62ef789d5e7fdbd3c) Signed-off-by: Reinhard Tartler <[email protected]> --- libavformat/oggdec.c | 14 ++++++++++++-- 1 files changed, 12 insertions(+), 2 deletions(-) diff --git a/libavformat/oggdec.c b/libavformat/oggdec.c index 76b28ab..bd00d1a 100644 --- a/libavformat/oggdec.c +++ b/libavformat/oggdec.c @@ -94,14 +94,24 @@ ogg_restore (AVFormatContext * s, int discard) ogg->state = ost->next; if (!discard){ + struct ogg_stream *old_streams = ogg->streams; + for (i = 0; i < ogg->nstreams; i++) av_free (ogg->streams[i].buf); url_fseek (bc, ost->pos, SEEK_SET); ogg->curidx = ost->curidx; ogg->nstreams = ost->nstreams; - memcpy(ogg->streams, ost->streams, - ost->nstreams * sizeof(*ogg->streams)); + ogg->streams = av_realloc (ogg->streams, + ogg->nstreams * sizeof (*ogg->streams)); + + if (ogg->streams) { + memcpy(ogg->streams, ost->streams, + ost->nstreams * sizeof(*ogg->streams)); + } else { + av_free(old_streams); + ogg->nstreams = 0; + } } av_free (ost); _______________________________________________ libav-commits mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-commits
