generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

ffmdec: reset packet_end in case of failure

Browse Source 
This fixes segmentation faults caused by passing a packet_ptr of NULL to
memcpy.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 40eb2531b2)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
This commit is contained in:
Andreas Cadhalpun
2016-01-02 16:27:02 +01:00
parent 46fcc2ba55
commit 33ad09205a
1 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
libavformat/ffmdec.c
View File

@@ -110,9 +110,10 @@ static int ffm_read_data(AVFormatContext *s,
ffm->dts = avio_rb64(pb);
frame_offset = avio_rb16(pb);
avio_read(pb, ffm->packet, ffm->packet_size - FFM_HEADER_SIZE);
ffm->packet_end = ffm->packet + (ffm->packet_size - FFM_HEADER_SIZE - fill_size);
if (ffm->packet_end < ffm->packet || frame_offset < 0)
if (ffm->packet_size < FFM_HEADER_SIZE + fill_size || frame_offset < 0) {
return -1;
}
ffm->packet_end = ffm->packet + (ffm->packet_size - FFM_HEADER_SIZE - fill_size);
/* if first packet or resynchronization packet, we must
handle it specifically */
if (ffm->first_packet || (frame_offset & 0x8000)) {
@@ -128,8 +129,10 @@ static int ffm_read_data(AVFormatContext *s,
return 0;
}
ffm->first_packet = 0;
if ((frame_offset & 0x7fff) < FFM_HEADER_SIZE)
if ((frame_offset & 0x7fff) < FFM_HEADER_SIZE) {
ffm->packet_end = ffm->packet_ptr;
return -1;
}
ffm->packet_ptr = ffm->packet + (frame_offset & 0x7fff) - FFM_HEADER_SIZE;
if (!header)
break;