aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorRonald S. Bultje <rsbultje@gmail.com>2012-02-24 16:12:18 -0800
committerRonald S. Bultje <rsbultje@gmail.com>2012-02-25 07:53:23 -0800
commitcd40c31ee9ad2cca6f3635950b002fd46be07e98 (patch)
treec0037f41b90c0dfcf7b9d71fc57bb1b379755d0d
parent03ca0a5b3000d705aba86ea2184df47303851f65 (diff)
downloadffmpeg-cd40c31ee9ad2cca6f3635950b002fd46be07e98.tar.gz
matroska: don't overwrite string values until read/alloc was succesful.
This prevents certain tags with a default value assigned to them (as per the EBML syntax elements) from ever being assigned a NULL value. Other parts of the code rely on these being non-NULL (i.e. they don't check for NULL before e.g. using the string in strcmp() or similar), and thus in effect this prevents crashes when reading of such specific tags fails, either because of low memory or because of targeted file corruption. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org
-rw-r--r--libavformat/matroskadec.c13
1 files changed, 8 insertions, 5 deletions
diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c
index 4d02488b19..eadf653028 100644
--- a/libavformat/matroskadec.c
+++ b/libavformat/matroskadec.c
@@ -639,16 +639,19 @@ static int ebml_read_float(AVIOContext *pb, int size, double *num)
*/
static int ebml_read_ascii(AVIOContext *pb, int size, char **str)
{
- av_free(*str);
+ char *res;
+
/* EBML strings are usually not 0-terminated, so we allocate one
* byte more, read the string and NULL-terminate it ourselves. */
- if (!(*str = av_malloc(size + 1)))
+ if (!(res = av_malloc(size + 1)))
return AVERROR(ENOMEM);
- if (avio_read(pb, (uint8_t *) *str, size) != size) {
- av_freep(str);
+ if (avio_read(pb, (uint8_t *) res, size) != size) {
+ av_free(res);
return AVERROR(EIO);
}
- (*str)[size] = '\0';
+ (res)[size] = '\0';
+ av_free(*str);
+ *str = res;
return 0;
}