virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-02-09 14:14:39 +02:00
Code Issues Releases Activity

Writing to freed memory in write_section_data() patch by (Wolfram Gloger <wmglo dent dot med dot uni-muenchen de>)

Browse Source 
Originally committed as revision 3957 to svn://svn.ffmpeg.org/ffmpeg/trunk
This commit is contained in:
Wolfram Gloger 2005-02-16 23:04:11 +00:00 committed by Michael Niedermayer
parent aabdc46187
commit 27bb1ed348
1 changed files with 7 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
libavformat/mpegts.c
View File

@ -116,7 +116,6 @@ static void write_section_data(AVFormatContext *s, MpegTSFilter *tss1,
{ {
MpegTSSectionFilter *tss = &tss1->u.section_filter; MpegTSSectionFilter *tss = &tss1->u.section_filter;
int len; int len;
unsigned int crc;
if (is_start) { if (is_start) {
memcpy(tss->section_buf, buf, buf_size); memcpy(tss->section_buf, buf, buf_size);
@ -142,14 +141,10 @@ static void write_section_data(AVFormatContext *s, MpegTSFilter *tss1,
} }
if (tss->section_h_size != -1 && tss->section_index >= tss->section_h_size) { if (tss->section_h_size != -1 && tss->section_index >= tss->section_h_size) {
if (tss->check_crc) {
crc = mpegts_crc32(tss->section_buf, tss->section_h_size);
if (crc != 0)
goto invalid_crc;
}
tss->section_cb(tss->opaque, tss->section_buf, tss->section_h_size);
invalid_crc:
tss->end_of_section_reached = 1; tss->end_of_section_reached = 1;
if (!tss->check_crc ||
mpegts_crc32(tss->section_buf, tss->section_h_size) == 0)
tss->section_cb(tss->opaque, tss->section_buf, tss->section_h_size);
} }
} }
@ -926,9 +921,12 @@ static void handle_packet(MpegTSContext *ts, const uint8_t *packet)
if (p + len > p_end) if (p + len > p_end)
return; return;
if (len && cc_ok) { if (len && cc_ok) {
/* write remaning section bytes */ /* write remaining section bytes */
write_section_data(s, tss, write_section_data(s, tss,
p, len, 0); p, len, 0);
/* check whether filter has been closed */
if (!ts->pids[pid])
return;
} }
p += len; p += len;
if (p < p_end) { if (p < p_end) {