diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2020-05-01 14:34:18 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2020-05-01 23:30:35 +0200 |
| commit | fb9e9da0b360d6eb3ff960e276d9c225d83d4bb1 (patch) | |
| tree | e251e4011e3929feb367740fb24d28d150f88356 | |
| parent | 5d5b0bbcb7d1d71a19dcec9b71fe59a4deea2fcd (diff) | |
| download | ffmpeg-fb9e9da0b360d6eb3ff960e276d9c225d83d4bb1.tar.gz | |
avformat/oggdec: Reallocate buffer before writing into it
Fixes: out of array write
Fixes: Regression since f619e1ec66b89215582eff4404b681b760540b4f
Reviewed-by: Lynne <dev@lynne.ee>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/oggdec.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/libavformat/oggdec.c b/libavformat/oggdec.c index a9034ea61c..7dd48af66c 100644 --- a/libavformat/oggdec.c +++ b/libavformat/oggdec.c @@ -441,6 +441,12 @@ static int ogg_read_page(AVFormatContext *s, int *sid, int probing) os = ogg->streams + idx; + ret = buf_realloc(os, size); + if (ret < 0) { + av_free(readout_buf); + return ret; + } + memcpy(os->buf + os->bufpos, readout_buf, size); av_free(readout_buf); } |