diff options
author | wm4 <nfxjfg@googlemail.com> | 2015-01-08 17:19:17 +0100 |
---|---|---|
committer | Michael Niedermayer <michaelni@gmx.at> | 2015-01-08 18:04:33 +0100 |
commit | a4a87a7efd8b72c0871491bcc85330e14beb8bd6 (patch) | |
tree | dcefaba8c8aa96c5a90cfb2b56f279abe15132e9 /libavformat/pva.c | |
parent | b76dc8b5b8f7a637b3232329d574a42af35878ca (diff) | |
download | ffmpeg-a4a87a7efd8b72c0871491bcc85330e14beb8bd6.tar.gz |
avcodec/dvdsubdec: fix accessing dangling pointers
dvdsub_decode() can call append_to_cached_buf() 2 times, the second time
with ctx->buf as argument. If the second append_to_cached_buf() reallocs
ctx->buf, the argument will be a pointer to the previous, freed block.
This can cause invalid reads at least with some fuzzed files - and
possibly with valid files.
Since packets can apparently not be larger than 64K (even if packets are
combined), just use a fixed size buffer. It will be allocated as part of
the DVDSubContext, and although some memory is "wasted", it's relatively
minimal by modern standards and should be acceptable.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 816577716bc6170bccfea3b9e865618b69a4b426)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat/pva.c')
0 files changed, 0 insertions, 0 deletions