aboutsummaryrefslogtreecommitdiffstats
path: root/libavformat
diff options
context:
space:
mode:
authorChris Evans <cevans@chromium.org>2012-01-05 21:19:30 +0100
committerReinhard Tartler <siretart@tauware.de>2012-01-05 21:21:57 +0100
commitfaaec4676cb4c7a2303d50df66c6290bc96a7657 (patch)
treeb9d404dfcdddf86fe0f72e05ea99d38faf9ff7b5 /libavformat
parentce23b2af18485499303ac1ac3aa9226ed69b240f (diff)
downloadffmpeg-faaec4676cb4c7a2303d50df66c6290bc96a7657.tar.gz
matroskadec: Fix a bug where a pointer was cached to an array that might later move due to a realloc()
Fixes bug #190 Chromium bug #100492 related to CVE-2011-3893 Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Diffstat (limited to 'libavformat')
-rw-r--r--libavformat/matroskadec.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c
index 2684d6e6d9..e5fbd43266 100644
--- a/libavformat/matroskadec.c
+++ b/libavformat/matroskadec.c
@@ -1188,7 +1188,6 @@ static int matroska_parse_seekhead_entry(MatroskaDemuxContext *matroska, int idx
static void matroska_execute_seekhead(MatroskaDemuxContext *matroska)
{
EbmlList *seekhead_list = &matroska->seekhead;
- MatroskaSeekhead *seekhead = seekhead_list->elem;
int64_t before_pos = avio_tell(matroska->ctx->pb);
int i;
@@ -1198,6 +1197,7 @@ static void matroska_execute_seekhead(MatroskaDemuxContext *matroska)
return;
for (i = 0; i < seekhead_list->nb_elem; i++) {
+ MatroskaSeekhead *seekhead = seekhead_list->elem;
if (seekhead[i].pos <= before_pos)
continue;