Hi,

On Wed, Mar 21, 2012 at 4:11 PM, Ronald S. Bultje <[email protected]> wrote:
> From: "Ronald S. Bultje" <[email protected]>
>
> Prevents crash (double free) when free()ing the original packet.
>
> Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
> CC: [email protected]
> ---
>  libavformat/asfdec.c |    2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/libavformat/asfdec.c b/libavformat/asfdec.c
> index 0789960..d3869b4 100644
> --- a/libavformat/asfdec.c
> +++ b/libavformat/asfdec.c
> @@ -1072,6 +1072,8 @@ static int ff_asf_parse_packet(AVFormatContext *s, 
> AVIOContext *pb, AVPacket *pk
>             //printf("packet %d %d\n", asf_st->pkt.size, 
> asf->packet_frag_size);
>             asf_st->pkt.size = 0;
>             asf_st->pkt.data = 0;
> +            asf_st->pkt.side_data_elems = 0;
> +            asf_st->pkt.side_data = NULL;

Ping.

Ronald
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel

Reply via email to