diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-04-17 14:03:26 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-04-17 14:03:26 +0200 |
| commit | 9bb3b7d028395a8fe70148dec89430e8aae7a7e2 (patch) | |
| tree | a3e38dfbd22197aa9ed9b76e86784a34d2e6d71b | |
| parent | 15141f939dc725451644869f4d413adb46927677 (diff) | |
| download | ffmpeg-9bb3b7d028395a8fe70148dec89430e8aae7a7e2.tar.gz | |
oggdec: Recreate streams only in the 1 stream case.
Other cases are not supported and lead to inconsistencies which
can lead to out of array writes.
Reported-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavformat/oggdec.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/libavformat/oggdec.c b/libavformat/oggdec.c index bdd2c5ba77..ab523790ec 100644 --- a/libavformat/oggdec.c +++ b/libavformat/oggdec.c @@ -247,6 +247,9 @@ static int ogg_read_page(AVFormatContext *s, int *str) if (ogg->headers) { int n; + if (ogg->nstreams != 1) + return idx; + for (n = 0; n < ogg->nstreams; n++) { av_freep(&ogg->streams[n].buf); if (!ogg->state || ogg->state->streams[n].private != ogg->streams[n].private) |