Module: libav Branch: master Commit: faaec4676cb4c7a2303d50df66c6290bc96a7657
Author: Chris Evans <[email protected]> Committer: Reinhard Tartler <[email protected]> Date: Thu Jan 5 21:19:30 2012 +0100 matroskadec: Fix a bug where a pointer was cached to an array that might later move due to a realloc() Fixes bug #190 Chromium bug #100492 related to CVE-2011-3893 Signed-off-by: Reinhard Tartler <[email protected]> --- libavformat/matroskadec.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c index 2684d6e..e5fbd43 100644 --- a/libavformat/matroskadec.c +++ b/libavformat/matroskadec.c @@ -1188,7 +1188,6 @@ static int matroska_parse_seekhead_entry(MatroskaDemuxContext *matroska, int idx static void matroska_execute_seekhead(MatroskaDemuxContext *matroska) { EbmlList *seekhead_list = &matroska->seekhead; - MatroskaSeekhead *seekhead = seekhead_list->elem; int64_t before_pos = avio_tell(matroska->ctx->pb); int i; @@ -1198,6 +1197,7 @@ static void matroska_execute_seekhead(MatroskaDemuxContext *matroska) return; for (i = 0; i < seekhead_list->nb_elem; i++) { + MatroskaSeekhead *seekhead = seekhead_list->elem; if (seekhead[i].pos <= before_pos) continue; _______________________________________________ libav-commits mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-commits
