matroskadec: Fix a bug where a pointer was cached to an array that might later move due to a realloc()
Fixes bug #190 Chromium bug #100492 related to CVE-2011-3893 Signed-off-by: Reinhard Tartler <siretart@tauware.de> (cherry-picked from commit faaec4676cb4c7a2303d50df66c6290bc96a7657) Signed-off-by: Reinhard Tartler <siretart@tauware.de> (cherry picked from commit 1f625431e2bb9564760fba3ab8077ae07ce7c7a1) Signed-off-by: Reinhard Tartler <siretart@tauware.de>
This commit is contained in:
parent
6d6254ba9f
commit
90a4a46747
@ -1074,13 +1074,13 @@ static void matroska_convert_tags(AVFormatContext *s)
|
||||
static void matroska_execute_seekhead(MatroskaDemuxContext *matroska)
|
||||
{
|
||||
EbmlList *seekhead_list = &matroska->seekhead;
|
||||
MatroskaSeekhead *seekhead = seekhead_list->elem;
|
||||
uint32_t level_up = matroska->level_up;
|
||||
int64_t before_pos = url_ftell(matroska->ctx->pb);
|
||||
MatroskaLevel level;
|
||||
int i;
|
||||
|
||||
for (i=0; i<seekhead_list->nb_elem; i++) {
|
||||
MatroskaSeekhead *seekhead = seekhead_list->elem;
|
||||
int64_t offset = seekhead[i].pos + matroska->segment_start;
|
||||
|
||||
if (seekhead[i].pos <= before_pos
|
||||
|
Loading…
x
Reference in New Issue
Block a user