diff options
| author | Laurent Aimar <fenrir@videolan.org> | 2011-09-11 23:37:44 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2011-09-21 18:03:01 +0200 |
| commit | be82df9e129995321917f47416ac755551915cb0 (patch) | |
| tree | aa865f77a233e5215ec5983e97372ec8992487d6 | |
| parent | b70a37f854df8b61be2055df352dfec40defce95 (diff) | |
| download | ffmpeg-be82df9e129995321917f47416ac755551915cb0.tar.gz | |
Fix writes out of bounds in the ogg demuxer.
Between ogg_save() and ogg_restore() calls, the number of streams
could have been reduced.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit bc851a2946c64eefb96145b70e2190ff7d5a4827)
| -rw-r--r-- | libavformat/oggdec.c | 15 |
1 files changed, 12 insertions, 3 deletions
diff --git a/libavformat/oggdec.c b/libavformat/oggdec.c index bb1df35619..6ae4d804ce 100644 --- a/libavformat/oggdec.c +++ b/libavformat/oggdec.c @@ -29,7 +29,6 @@ DEALINGS IN THE SOFTWARE. **/ - #include <stdio.h> #include "oggdec.h" #include "avformat.h" @@ -93,14 +92,24 @@ static int ogg_restore(AVFormatContext *s, int discard) ogg->state = ost->next; if (!discard){ + struct ogg_stream *old_streams = ogg->streams; + for (i = 0; i < ogg->nstreams; i++) av_free (ogg->streams[i].buf); avio_seek (bc, ost->pos, SEEK_SET); ogg->curidx = ost->curidx; ogg->nstreams = ost->nstreams; - memcpy(ogg->streams, ost->streams, - ost->nstreams * sizeof(*ogg->streams)); + ogg->streams = av_realloc (ogg->streams, + ogg->nstreams * sizeof (*ogg->streams)); + + if (ogg->streams) { + memcpy(ogg->streams, ost->streams, + ost->nstreams * sizeof(*ogg->streams)); + } else { + av_free(old_streams); + ogg->nstreams = 0; + } } av_free (ost); |