diff options
| author | Laurent Aimar <fenrir@videolan.org> | 2011-09-11 23:26:12 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2011-11-03 03:28:27 +0100 |
| commit | 52b8edc94c9fa4c613fdfdc0a53512d0ac26345f (patch) | |
| tree | cb694c9685fa2a0336f782fe7aeeeb88847a0447 | |
| parent | f936799f0b72799000cd842922a05005f70cb553 (diff) | |
| download | ffmpeg-52b8edc94c9fa4c613fdfdc0a53512d0ac26345f.tar.gz | |
oggdec: fix out of bound write in the ogg demuxer
Between ogg_save() and ogg_restore() calls, the number of streams
could have been reduced.
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 0e7efb9d23c3641d50caa288818e8c27647ce74d)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
| -rw-r--r-- | libavformat/oggdec.c | 14 |
1 files changed, 12 insertions, 2 deletions
diff --git a/libavformat/oggdec.c b/libavformat/oggdec.c index 54406f5479..a810b95dee 100644 --- a/libavformat/oggdec.c +++ b/libavformat/oggdec.c @@ -90,14 +90,24 @@ ogg_restore (AVFormatContext * s, int discard) ogg->state = ost->next; if (!discard){ + struct ogg_stream *old_streams = ogg->streams; + for (i = 0; i < ogg->nstreams; i++) av_free (ogg->streams[i].buf); url_fseek (bc, ost->pos, SEEK_SET); ogg->curidx = ost->curidx; ogg->nstreams = ost->nstreams; - memcpy(ogg->streams, ost->streams, - ost->nstreams * sizeof(*ogg->streams)); + ogg->streams = av_realloc (ogg->streams, + ogg->nstreams * sizeof (*ogg->streams)); + + if (ogg->streams) { + memcpy(ogg->streams, ost->streams, + ost->nstreams * sizeof(*ogg->streams)); + } else { + av_free(old_streams); + ogg->nstreams = 0; + } } av_free (ost); |