[FFmpeg-cvslog] matroskadec: Fix a bug where a pointer was cached to an array that might later move due to a realloc ()
Chris Evans
git at videolan.org
Sun Jan 8 07:52:53 CET 2012
ffmpeg | branch: release/0.8 | Chris Evans <cevans at chromium.org> | Thu Jan 5 21:19:30 2012 +0100| [1f625431e2bb9564760fba3ab8077ae07ce7c7a1] | committer: Reinhard Tartler
matroskadec: Fix a bug where a pointer was cached to an array that might later move due to a realloc()
Fixes bug #190
Chromium bug #100492
related to CVE-2011-3893
Signed-off-by: Reinhard Tartler <siretart at tauware.de>
(cherry-picked from commit faaec4676cb4c7a2303d50df66c6290bc96a7657)
Signed-off-by: Reinhard Tartler <siretart at tauware.de>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1f625431e2bb9564760fba3ab8077ae07ce7c7a1
---
libavformat/matroskadec.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c
index 59dce4f..fad554f 100644
--- a/libavformat/matroskadec.c
+++ b/libavformat/matroskadec.c
@@ -1134,7 +1134,6 @@ static void matroska_convert_tags(AVFormatContext *s)
static void matroska_execute_seekhead(MatroskaDemuxContext *matroska)
{
EbmlList *seekhead_list = &matroska->seekhead;
- MatroskaSeekhead *seekhead = seekhead_list->elem;
uint32_t level_up = matroska->level_up;
int64_t before_pos = avio_tell(matroska->ctx->pb);
uint32_t saved_id = matroska->current_id;
@@ -1147,6 +1146,7 @@ static void matroska_execute_seekhead(MatroskaDemuxContext *matroska)
return;
for (i=0; i<seekhead_list->nb_elem; i++) {
+ MatroskaSeekhead *seekhead = seekhead_list->elem;
int64_t offset = seekhead[i].pos + matroska->segment_start;
if (seekhead[i].pos <= before_pos
More information about the ffmpeg-cvslog
mailing list