From 3562684db716d11de0b0dcc52748e9cd90d68132 Mon Sep 17 00:00:00 2001 From: Luca Barbato Date: Tue, 13 Aug 2013 07:28:41 +0200 Subject: [PATCH] ogg: Always alloc the private context in vorbis_header It is possible to have an initial broken header and then valid packets. Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org --- libavformat/oggparsevorbis.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/libavformat/oggparsevorbis.c b/libavformat/oggparsevorbis.c index db462fc865..adf8f0360a 100644 --- a/libavformat/oggparsevorbis.c +++ b/libavformat/oggparsevorbis.c @@ -212,15 +212,15 @@ vorbis_header (AVFormatContext * s, int idx) struct oggvorbis_private *priv; int pkt_type = os->buf[os->pstart]; - if (!(pkt_type & 1)) - return 0; - if (!os->private) { os->private = av_mallocz(sizeof(struct oggvorbis_private)); if (!os->private) return 0; } + if (!(pkt_type & 1)) + return 0; + if (os->psize < 1 || pkt_type > 5) return -1;