diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-07-01 23:38:08 +0200 |
|---|---|---|
| committer | Carl Eugen Hoyos <cehoyos@ag.or.at> | 2013-07-07 18:55:17 +0200 |
| commit | 8514e3e08e234fbae7e994c8310730d1a6be1724 (patch) | |
| tree | b8632f0ff6cd3850e1be111c50404169a082e2f9 /libavformat | |
| parent | 5e6135f68d77b0560373a655789c04fdb3be6df1 (diff) | |
| download | ffmpeg-8514e3e08e234fbae7e994c8310730d1a6be1724.tar.gz | |
rmdec: Pass AVIOContext to rm_read_metadata()
Fix null pointer dereference
Fixes Ticket2588
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit bf87908cd8da31e8f8fe75c06577170928ea70a8)
Conflicts:
libavformat/rmdec.c
Diffstat (limited to 'libavformat')
| -rw-r--r-- | libavformat/rmdec.c | 13 |
1 files changed, 7 insertions, 6 deletions
diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c index 3032c8f43a..5d1791f79f 100644 --- a/libavformat/rmdec.c +++ b/libavformat/rmdec.c @@ -107,13 +107,14 @@ static int rm_read_extradata(AVIOContext *pb, AVCodecContext *avctx, unsigned si return 0; } -static void rm_read_metadata(AVFormatContext *s, int wide) +static void rm_read_metadata(AVFormatContext *s, AVIOContext *pb, int wide) { char buf[1024]; int i; + for (i=0; i<FF_ARRAY_ELEMS(ff_rm_metadata); i++) { - int len = wide ? avio_rb16(s->pb) : avio_r8(s->pb); - get_strl(s->pb, buf, sizeof(buf), len); + int len = wide ? avio_rb16(pb) : avio_r8(pb); + get_strl(pb, buf, sizeof(buf), len); av_dict_set(&s->metadata, ff_rm_metadata[i], buf, 0); } } @@ -143,7 +144,7 @@ static int rm_read_audio_stream_info(AVFormatContext *s, AVIOContext *pb, int header_size = avio_rb16(pb); int64_t startpos = avio_tell(pb); avio_skip(pb, 14); - rm_read_metadata(s, 0); + rm_read_metadata(s, pb, 0); if ((startpos + header_size) >= avio_tell(pb) + 2) { // fourcc (should always be "lpcJ") avio_r8(pb); @@ -289,7 +290,7 @@ static int rm_read_audio_stream_info(AVFormatContext *s, AVIOContext *pb, avio_r8(pb); avio_r8(pb); avio_r8(pb); - rm_read_metadata(s, 0); + rm_read_metadata(s, pb, 0); } } return 0; @@ -475,7 +476,7 @@ static int rm_read_header(AVFormatContext *s, AVFormatParameters *ap) flags = avio_rb16(pb); /* flags */ break; case MKTAG('C', 'O', 'N', 'T'): - rm_read_metadata(s, 1); + rm_read_metadata(s, pb, 1); break; case MKTAG('M', 'D', 'P', 'R'): st = avformat_new_stream(s, NULL); |