From 15ebcbaaf465dc5ff0bd4048139bec6548f47d66 Mon Sep 17 00:00:00 2001 From: Pascal Massimino Date: Mon, 23 Apr 2012 08:20:22 -0700 Subject: [PATCH] check return pointer from MuxImageGetListFromId previously, it could crash with nth=1 on a raw vp8 bitstream, e.g. Change-Id: Ice555d95b984ba71017fc56314d0c2c1b5bdf599 --- src/mux/muxinternal.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/src/mux/muxinternal.c b/src/mux/muxinternal.c index def73abd..e9a3be95 100644 --- a/src/mux/muxinternal.c +++ b/src/mux/muxinternal.c @@ -248,11 +248,8 @@ int MuxImageCount(WebPMuxImage* const wpi_list, TAG_ID id) { int count = 0; WebPMuxImage* current; for (current = wpi_list; current != NULL; current = current->next_) { - WebPChunk** const wpi_chunk_ptr = MuxImageGetListFromId(current, id); - assert(wpi_chunk_ptr != NULL); - - if (*wpi_chunk_ptr != NULL && - (*wpi_chunk_ptr)->tag_ == kChunks[id].chunkTag) { + const WebPChunk* const wpi_chunk = *MuxImageGetListFromId(current, id); + if (wpi_chunk != NULL && wpi_chunk->tag_ == kChunks[id].chunkTag) { ++count; } } @@ -300,9 +297,8 @@ static int SearchImageToGetOrDelete(WebPMuxImage** wpi_list, uint32_t nth, while (*wpi_list) { WebPMuxImage* const cur_wpi = *wpi_list; - WebPChunk** const wpi_chunk_ptr = MuxImageGetListFromId(cur_wpi, id); - assert(wpi_chunk_ptr != NULL); - if ((*wpi_chunk_ptr)->tag_ == kChunks[id].chunkTag) { + const WebPChunk* const wpi_chunk = *MuxImageGetListFromId(cur_wpi, id); + if (wpi_chunk != NULL && wpi_chunk->tag_ == kChunks[id].chunkTag) { ++count; if (count == nth) return 1; // Found. }