Browse Source

Fix writes out of bounds in the ogg demuxer.

Between ogg_save() and ogg_restore() calls, the number of streams
could have been reduced.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
tags/n0.9
Laurent Aimar Michael Niedermayer 13 years ago
parent
commit
bc851a2946
1 changed files with 12 additions and 3 deletions
  1. +12
    -3
      libavformat/oggdec.c

+ 12
- 3
libavformat/oggdec.c View File

@@ -29,7 +29,6 @@
DEALINGS IN THE SOFTWARE.
**/


#include <stdio.h>
#include "oggdec.h"
#include "avformat.h"
@@ -93,14 +92,24 @@ static int ogg_restore(AVFormatContext *s, int discard)
ogg->state = ost->next;

if (!discard){
struct ogg_stream *old_streams = ogg->streams;

for (i = 0; i < ogg->nstreams; i++)
av_free (ogg->streams[i].buf);

avio_seek (bc, ost->pos, SEEK_SET);
ogg->curidx = ost->curidx;
ogg->nstreams = ost->nstreams;
memcpy(ogg->streams, ost->streams,
ost->nstreams * sizeof(*ogg->streams));
ogg->streams = av_realloc (ogg->streams,
ogg->nstreams * sizeof (*ogg->streams));

if (ogg->streams) {
memcpy(ogg->streams, ost->streams,
ost->nstreams * sizeof(*ogg->streams));
} else {
av_free(old_streams);
ogg->nstreams = 0;
}
}

av_free (ost);


Loading…
Cancel
Save