[FFmpeg-cvslog] mkv: Fix a bug where a pointer was cached to an array that might later move due to
Chris Evans
git at videolan.org
Thu Jan 5 01:13:02 CET 2012
ffmpeg | branch: release/0.9 | Chris Evans <cevans at chromium.org> | Wed Jan 4 16:33:34 2012 +0100| [49b8709870e4fa4d577ce6909d4bc6e03cedfe4e] | committer: Michael Niedermayer
mkv: Fix a bug where a pointer was cached to an array that might later move due to
a realloc()
BUG=100492
Review URL: http://codereview.chromium.org/8366004
Fixes: 1 of 2 for CVE-2011-3893
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
(cherry picked from commit f35e037c93cf7d25e65b4a2ed3674358f05e4bed)
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=49b8709870e4fa4d577ce6909d4bc6e03cedfe4e
---
libavformat/matroskadec.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c
index 4a0c2fa..c02013e 100644
--- a/libavformat/matroskadec.c
+++ b/libavformat/matroskadec.c
@@ -1223,7 +1223,6 @@ static int matroska_parse_seekhead_entry(MatroskaDemuxContext *matroska, int idx
static void matroska_execute_seekhead(MatroskaDemuxContext *matroska)
{
EbmlList *seekhead_list = &matroska->seekhead;
- MatroskaSeekhead *seekhead = seekhead_list->elem;
int64_t before_pos = avio_tell(matroska->ctx->pb);
int i;
@@ -1233,6 +1232,7 @@ static void matroska_execute_seekhead(MatroskaDemuxContext *matroska)
return;
for (i = 0; i < seekhead_list->nb_elem; i++) {
+ MatroskaSeekhead *seekhead = seekhead_list->elem;
if (seekhead[i].pos <= before_pos)
continue;
More information about the ffmpeg-cvslog
mailing list