[FFmpeg-cvslog] r25684 - trunk/libavformat/rtspdec.c

[mstorsjo]

Author: mstorsjo
Date: Sun Nov  7 00:26:49 2010
New Revision: 25684

Log:
rtsp: Set the real_setup pointer properly, avoid out of bounds memory accesses

This fixes a regression since svn rev 24752, where the real_setup pointer
was set incorrectly. The arithmetic with the real_setup_cache pointer
is in units of enum AVDiscard, so the sizeof multiplication should be removed.

Patch by Yuriy Kaminskiy, yumkam at mail dot ru.

Modified:
   trunk/libavformat/rtspdec.c

Modified: trunk/libavformat/rtspdec.c
==============================================================================
--- trunk/libavformat/rtspdec.c	Sat Nov  6 17:48:41 2010	(r25683)
+++ trunk/libavformat/rtspdec.c	Sun Nov  7 00:26:49 2010	(r25684)
@@ -136,7 +136,7 @@ static int rtsp_read_header(AVFormatCont
     rt->real_setup_cache = av_mallocz(2 * s->nb_streams * sizeof(*rt->real_setup_cache));
     if (!rt->real_setup_cache)
         return AVERROR(ENOMEM);
-    rt->real_setup = rt->real_setup_cache + s->nb_streams * sizeof(*rt->real_setup);
+    rt->real_setup = rt->real_setup_cache + s->nb_streams;
 
     if (ap->initial_pause) {
          /* do not start immediately */