Module: libav Branch: release/0.5 Commit: 7ee536e87a569174775dabdd959a9b12c1d2ac3d
Author: Chris Evans <[email protected]> Committer: Reinhard Tartler <[email protected]> Date: Thu Jan 5 21:19:30 2012 +0100 matroskadec: Fix a bug where a pointer was cached to an array that might later move due to a realloc() Fixes bug #190 Chromium bug #100492 related to CVE-2011-3893 Signed-off-by: Reinhard Tartler <[email protected]> (cherry-picked from commit faaec4676cb4c7a2303d50df66c6290bc96a7657) Signed-off-by: Reinhard Tartler <[email protected]> (cherry picked from commit 1f625431e2bb9564760fba3ab8077ae07ce7c7a1) Signed-off-by: Reinhard Tartler <[email protected]> (cherry picked from commit 90a4a467477be8c292daa08a9516ee78ca0d517b) Signed-off-by: Reinhard Tartler <[email protected]> --- libavformat/matroskadec.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c index d9ffec3..e16cd1e 100644 --- a/libavformat/matroskadec.c +++ b/libavformat/matroskadec.c @@ -1063,13 +1063,13 @@ static void matroska_convert_tags(AVFormatContext *s) static void matroska_execute_seekhead(MatroskaDemuxContext *matroska) { EbmlList *seekhead_list = &matroska->seekhead; - MatroskaSeekhead *seekhead = seekhead_list->elem; uint32_t level_up = matroska->level_up; int64_t before_pos = url_ftell(matroska->ctx->pb); MatroskaLevel level; int i; for (i=0; i<seekhead_list->nb_elem; i++) { + MatroskaSeekhead *seekhead = seekhead_list->elem; int64_t offset = seekhead[i].pos + matroska->segment_start; if (seekhead[i].pos <= before_pos _______________________________________________ libav-commits mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-commits
