[FFmpeg-cvslog] oggdec: prevent heap corruption.
Chris Evans
git at videolan.org
Wed Jul 27 12:49:43 CEST 2011
ffmpeg | branch: release/0.7 | Chris Evans <cevans at chromium.org> | Wed Jun 29 15:44:40 2011 -0700| [cd63c32ff6f6a24dc971a0bb2ca8f8a4f57e79da] | committer: Reinhard Tartler
oggdec: prevent heap corruption.
Specifically crafted samples can reinit ogg->streams[] while
reading samples, and thus we should not cache old pointers since
these may no longer be valid.
Signed-off-by: Ronald S. Bultje <rsbultje at gmail.com>
(cherry picked from commit 4cc3467e7abfea7e8d03b6af511f7719038a5a98)
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=cd63c32ff6f6a24dc971a0bb2ca8f8a4f57e79da
---
libavformat/oggdec.c | 5 +++--
1 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/libavformat/oggdec.c b/libavformat/oggdec.c
index 49f24e9..25f5cd8 100644
--- a/libavformat/oggdec.c
+++ b/libavformat/oggdec.c
@@ -583,15 +583,15 @@ static int64_t ogg_read_timestamp(AVFormatContext *s, int stream_index,
int64_t *pos_arg, int64_t pos_limit)
{
struct ogg *ogg = s->priv_data;
- struct ogg_stream *os = ogg->streams + stream_index;
AVIOContext *bc = s->pb;
int64_t pts = AV_NOPTS_VALUE;
- int i;
+ int i = -1;
avio_seek(bc, *pos_arg, SEEK_SET);
ogg_reset(ogg);
while (avio_tell(bc) < pos_limit && !ogg_packet(s, &i, NULL, NULL, pos_arg)) {
if (i == stream_index) {
+ struct ogg_stream *os = ogg->streams + stream_index;
pts = ogg_calc_pts(s, i, NULL);
if (os->keyframe_seek && !(os->pflags & AV_PKT_FLAG_KEY))
pts = AV_NOPTS_VALUE;
@@ -617,6 +617,7 @@ static int ogg_read_seek(AVFormatContext *s, int stream_index,
os->keyframe_seek = 1;
ret = av_seek_frame_binary(s, stream_index, timestamp, flags);
+ os = ogg->streams + stream_index;
if (ret < 0)
os->keyframe_seek = 0;
return ret;
More information about the ffmpeg-cvslog
mailing list