Traneptora/FFmpeg
1
Fork 0
forked from FFmpeg/FFmpeg
Code Pull requests Activity

oggdec: prevent heap corruption.

Browse source 
Specifically crafted samples can reinit ogg->streams[] while
reading samples, and thus we should not cache old pointers since
these may no longer be valid.

Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
This commit is contained in:
Chris Evans 2011-06-29 15:44:40 -07:00 • committed by Ronald S. Bultje
parent b047941d7d
commit 4cc3467e7a
1 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
libavformat/oggdec.c
View file

@ -592,15 +592,15 @@ static int64_t ogg_read_timestamp(AVFormatContext *s, int stream_index,
int64_t *pos_arg, int64_t pos_limit) int64_t *pos_arg, int64_t pos_limit)
{ {
struct ogg *ogg = s->priv_data; struct ogg *ogg = s->priv_data;
struct ogg_stream *os = ogg->streams + stream_index;
AVIOContext *bc = s->pb; AVIOContext *bc = s->pb;
int64_t pts = AV_NOPTS_VALUE; int64_t pts = AV_NOPTS_VALUE;
int i; int i = -1;
avio_seek(bc, *pos_arg, SEEK_SET); avio_seek(bc, *pos_arg, SEEK_SET);
ogg_reset(ogg); ogg_reset(ogg);
while (avio_tell(bc) < pos_limit && !ogg_packet(s, &i, NULL, NULL, pos_arg)) { while (avio_tell(bc) < pos_limit && !ogg_packet(s, &i, NULL, NULL, pos_arg)) {
if (i == stream_index) { if (i == stream_index) {
struct ogg_stream *os = ogg->streams + stream_index;
pts = ogg_calc_pts(s, i, NULL); pts = ogg_calc_pts(s, i, NULL);
if (os->keyframe_seek && !(os->pflags & AV_PKT_FLAG_KEY)) if (os->keyframe_seek && !(os->pflags & AV_PKT_FLAG_KEY))
pts = AV_NOPTS_VALUE; pts = AV_NOPTS_VALUE;
@ -626,6 +626,7 @@ static int ogg_read_seek(AVFormatContext *s, int stream_index,
os->keyframe_seek = 1; os->keyframe_seek = 1;
ret = av_seek_frame_binary(s, stream_index, timestamp, flags); ret = av_seek_frame_binary(s, stream_index, timestamp, flags);
os = ogg->streams + stream_index;
if (ret < 0) if (ret < 0)
os->keyframe_seek = 0; os->keyframe_seek = 0;
return ret; return ret;