diff options
| author | Anton Khirnov <anton@khirnov.net> | 2016-12-28 13:15:14 +0100 |
|---|---|---|
| committer | Sean McGovern <gseanmcg@gmail.com> | 2017-01-04 20:05:44 -0500 |
| commit | 9026ec8aaf5fa19cb4fb266c16f608af0d863b2b (patch) | |
| tree | 480383cd7ef0f87349ecc45069d6be6ab2aed0ba /libavformat/matroskadec.c | |
| parent | 9b1db2d33883c6ff3f8c7b2453146501ba14ca20 (diff) | |
| download | ffmpeg-9026ec8aaf5fa19cb4fb266c16f608af0d863b2b.tar.gz | |
matroskadec: make sure not to leave EbmlBin in an inconsistent state
If a read fails, the current code will free the data but leave the size
non-zero. Make sure the size is zeroed in such a case.
CC: libav-stable@libav.org
Bug-Id: 1001
Found-By: Kamil Frankowicz
Signed-off-by: Sean McGovern <gseanmcg@gmail.com>
Diffstat (limited to 'libavformat/matroskadec.c')
| -rw-r--r-- | libavformat/matroskadec.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c index a3954b0c4e..4e121b6afe 100644 --- a/libavformat/matroskadec.c +++ b/libavformat/matroskadec.c @@ -750,16 +750,19 @@ static int ebml_read_ascii(AVIOContext *pb, int size, char **str) static int ebml_read_binary(AVIOContext *pb, int length, EbmlBin *bin) { av_free(bin->data); + bin->size = 0; + if (!(bin->data = av_mallocz(length + AV_INPUT_BUFFER_PADDING_SIZE))) return AVERROR(ENOMEM); - bin->size = length; bin->pos = avio_tell(pb); if (avio_read(pb, bin->data, length) != length) { av_freep(&bin->data); return AVERROR(EIO); } + bin->size = length; + return 0; } |