aboutsummaryrefslogtreecommitdiffstats
path: root/tests/ref/fate/vp9-02-size-08x66
diff options
context:
space:
mode:
authorwm4 <nfxjfg@googlemail.com>2015-01-08 17:19:17 +0100
committerMichael Niedermayer <michaelni@gmx.at>2015-01-09 17:18:41 +0100
commit3b4e9dddcff61eaf01a9a5b63c1abcc4102a313a (patch)
tree9b4eea5a9a08af3464a5dfb551cfc5b473cf2042 /tests/ref/fate/vp9-02-size-08x66
parent2ba1af5791fc405ad648851344fe6dd83d1c92c1 (diff)
downloadffmpeg-3b4e9dddcff61eaf01a9a5b63c1abcc4102a313a.tar.gz
avcodec/dvdsubdec: fix accessing dangling pointers
dvdsub_decode() can call append_to_cached_buf() 2 times, the second time with ctx->buf as argument. If the second append_to_cached_buf() reallocs ctx->buf, the argument will be a pointer to the previous, freed block. This can cause invalid reads at least with some fuzzed files - and possibly with valid files. Since packets can apparently not be larger than 64K (even if packets are combined), just use a fixed size buffer. It will be allocated as part of the DVDSubContext, and although some memory is "wasted", it's relatively minimal by modern standards and should be acceptable. Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 816577716bc6170bccfea3b9e865618b69a4b426) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'tests/ref/fate/vp9-02-size-08x66')
0 files changed, 0 insertions, 0 deletions