generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

oggdec: fix out of bound write in the ogg demuxer

Browse Source 
Between ogg_save() and ogg_restore() calls, the number of streams
could have been reduced.

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 0e7efb9d23c3641d50caa288818e8c27647ce74d)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit a3d471e500674c31fa4f52a62ef789d5e7fdbd3c)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
This commit is contained in:
Laurent Aimar 2011-09-11 23:26:12 +02:00 committed by Reinhard Tartler
parent 19a99b6e6b
commit 23f622de60
1 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
libavformat/oggdec.c
View File

@ -94,14 +94,24 @@ ogg_restore (AVFormatContext * s, int discard)
ogg->state = ost->next;
if (!discard){
struct ogg_stream *old_streams = ogg->streams;
for (i = 0; i < ogg->nstreams; i++)
av_free (ogg->streams[i].buf);
url_fseek (bc, ost->pos, SEEK_SET);
ogg->curidx = ost->curidx;
ogg->nstreams = ost->nstreams;
memcpy(ogg->streams, ost->streams,
ost->nstreams * sizeof(*ogg->streams));
ogg->streams = av_realloc (ogg->streams,
ogg->nstreams * sizeof (*ogg->streams));
if (ogg->streams) {
memcpy(ogg->streams, ost->streams,
ost->nstreams * sizeof(*ogg->streams));
} else {
av_free(old_streams);
ogg->nstreams = 0;
}
}
av_free (ost);