generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

oggdec: prevent heap corruption.

Browse Source 
Specifically crafted samples can reinit ogg->streams[] while
reading samples, and thus we should not cache old pointers since
these may no longer be valid.

Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
(cherry-picked from commit 4cc3467e7abfea7e8d03b6af511f7719038a5a98)
This commit is contained in:
Chris Evans 2011-08-04 22:00:29 +02:00 committed by Reinhard Tartler
parent 03ef9828b5
commit 88ea7ca627
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
libavformat/oggdec.c
View File

@ -577,20 +577,19 @@ ogg_read_close (AVFormatContext * s)
}
static int64_t
ogg_read_timestamp (AVFormatContext * s, int stream_index, int64_t * pos_arg,
int64_t pos_limit)
static int64_t ogg_read_timestamp (AVFormatContext * s, int stream_index,
int64_t * pos_arg, int64_t pos_limit)
{
struct ogg *ogg = s->priv_data;
struct ogg_stream *os = ogg->streams + stream_index;
ByteIOContext *bc = s->pb;
int64_t pts = AV_NOPTS_VALUE;
int i;
int i = -1;
url_fseek(bc, *pos_arg, SEEK_SET);
ogg_reset(ogg);
while (url_ftell(bc) < pos_limit && !ogg_packet(s, &i, NULL, NULL, pos_arg)) {
if (i == stream_index) {
struct ogg_stream *os = ogg->streams + stream_index;
pts = ogg_calc_pts(s, i, NULL);
if (os->keyframe_seek && !(os->pflags & AV_PKT_FLAG_KEY))
pts = AV_NOPTS_VALUE;
@ -615,6 +614,7 @@ static int ogg_read_seek(AVFormatContext *s, int stream_index, int64_t timestamp
os->keyframe_seek = 1;
ret = av_seek_frame_binary(s, stream_index, timestamp, flags);
os = ogg->streams + stream_index;
if (ret < 0)
os->keyframe_seek = 0;
return ret;