diff options
| author | Michael Niedermayer <[email protected]> | 2024-02-27 02:07:28 +0100 |
|---|---|---|
| committer | Michael Niedermayer <[email protected]> | 2024-04-01 19:03:06 +0200 |
| commit | cb9752d897de17212a7a3ce54ad3e16b377b22c0 (patch) | |
| tree | a9b50599c4b7e23e1d7b5d8dabad6809c2f1a5b4 | |
| parent | c0532f5579dcca4ad1d4c8db2068be7554c7cb63 (diff) | |
avformat/mpegts: Reset local nb_prg on add_program() failure
add_program() will deallocate the whole array on failure so
we must clear nb_prgs
Fixes: null pointer dereference
Fixes: crash-35a3b39ddcc5babeeb005b7399a3a1217c8781bc
Found-by: Catena cyber
Signed-off-by: Michael Niedermayer <[email protected]>
| -rw-r--r-- | libavformat/mpegts.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c index d540126172..3a5cb769ba 100644 --- a/libavformat/mpegts.c +++ b/libavformat/mpegts.c @@ -2603,7 +2603,8 @@ static void pat_cb(MpegTSFilter *filter, const uint8_t *section, int section_len FFSWAP(struct Program, ts->prg[nb_prg], ts->prg[prg_idx]); if (prg_idx >= nb_prg) nb_prg++; - } + } else + nb_prg = 0; } } ts->nb_prg = nb_prg; |