diff options
| author | Chris Evans <cevans@chromium.org> | 2012-01-05 21:19:30 +0100 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2012-01-07 22:16:29 +0100 |
| commit | 7ee536e87a569174775dabdd959a9b12c1d2ac3d (patch) | |
| tree | b85c6dfd04be622689a94c722927c48b2407d99b | |
| parent | 665421f3b1a626610206410e5dc12e5e236b92a2 (diff) | |
| download | ffmpeg-7ee536e87a569174775dabdd959a9b12c1d2ac3d.tar.gz | |
matroskadec: Fix a bug where a pointer was cached to an array that might later move due to a realloc()
Fixes bug #190
Chromium bug #100492
related to CVE-2011-3893
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry-picked from commit faaec4676cb4c7a2303d50df66c6290bc96a7657)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 1f625431e2bb9564760fba3ab8077ae07ce7c7a1)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 90a4a467477be8c292daa08a9516ee78ca0d517b)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| -rw-r--r-- | libavformat/matroskadec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c index d9ffec3727..e16cd1efd4 100644 --- a/libavformat/matroskadec.c +++ b/libavformat/matroskadec.c @@ -1063,13 +1063,13 @@ static void matroska_convert_tags(AVFormatContext *s) static void matroska_execute_seekhead(MatroskaDemuxContext *matroska) { EbmlList *seekhead_list = &matroska->seekhead; - MatroskaSeekhead *seekhead = seekhead_list->elem; uint32_t level_up = matroska->level_up; int64_t before_pos = url_ftell(matroska->ctx->pb); MatroskaLevel level; int i; for (i=0; i<seekhead_list->nb_elem; i++) { + MatroskaSeekhead *seekhead = seekhead_list->elem; int64_t offset = seekhead[i].pos + matroska->segment_start; if (seekhead[i].pos <= before_pos |