Re: [FFmpeg-devel] [PATCH] avformat/mpegts: Reset local nb_prg on add_program() failure
On Sun, Mar 10, 2024 at 07:07:19PM +0100, Michael Niedermayer wrote: > add_program() will deallocate the whole array on failure so > we must clear nb_prgs > > Fixes: null pointer dereference > Fixes: crash-35a3b39ddcc5babeeb005b7399a3a1217c8781bc > > Found-by: Catena cyber > Signed-off-by: Michael Niedermayer > --- > libavformat/mpegts.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) will apply [...] -- Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB Breaking DRM is a little like attempting to break through a door even though the window is wide open and the only thing in the house is a bunch of things you dont want and which you would get tomorrow for free anyway signature.asc Description: PGP signature ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-devel] [PATCH] avformat/mpegts: Reset local nb_prg on add_program() failure
add_program() will deallocate the whole array on failure so we must clear nb_prgs Fixes: null pointer dereference Fixes: crash-35a3b39ddcc5babeeb005b7399a3a1217c8781bc Found-by: Catena cyber Signed-off-by: Michael Niedermayer --- libavformat/mpegts.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c index de7a3c8b45..320926248b 100644 --- a/libavformat/mpegts.c +++ b/libavformat/mpegts.c @@ -2605,7 +2605,8 @@ static void pat_cb(MpegTSFilter *filter, const uint8_t *section, int section_len FFSWAP(struct Program, ts->prg[nb_prg], ts->prg[prg_idx]); if (prg_idx >= nb_prg) nb_prg++; -} +} else +nb_prg = 0; } } ts->nb_prg = nb_prg; -- 2.17.1 ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
