virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-02-14 22:22:59 +02:00
Code Issues Releases Activity

ffmdec: reset packet_end in case of failure

Browse Source 
This fixes segmentation faults caused by passing a packet_ptr of NULL to
memcpy.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 40eb2531b279abe008012c5c2c292552d3e62449)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
This commit is contained in:
Andreas Cadhalpun 2016-01-02 16:27:02 +01:00
parent 7b0fb4fdf7
commit 667a23a032
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
libavformat/ffmdec.c
View File

@ -114,9 +114,10 @@ static int ffm_read_data(AVFormatContext *s,
ffm->dts = avio_rb64(pb); ffm->dts = avio_rb64(pb);
frame_offset = avio_rb16(pb); frame_offset = avio_rb16(pb);
avio_read(pb, ffm->packet, ffm->packet_size - FFM_HEADER_SIZE); avio_read(pb, ffm->packet, ffm->packet_size - FFM_HEADER_SIZE);
ffm->packet_end = ffm->packet + (ffm->packet_size - FFM_HEADER_SIZE - fill_size); if (ffm->packet_size < FFM_HEADER_SIZE + fill_size || frame_offset < 0) {
if (ffm->packet_end < ffm->packet || frame_offset < 0)
return -1; return -1;
}
ffm->packet_end = ffm->packet + (ffm->packet_size - FFM_HEADER_SIZE - fill_size);
/* if first packet or resynchronization packet, we must /* if first packet or resynchronization packet, we must
handle it specifically */ handle it specifically */
if (ffm->first_packet || (frame_offset & 0x8000)) { if (ffm->first_packet || (frame_offset & 0x8000)) {
@ -132,8 +133,10 @@ static int ffm_read_data(AVFormatContext *s,
return 0; return 0;
} }
ffm->first_packet = 0; ffm->first_packet = 0;
if ((frame_offset & 0x7fff) < FFM_HEADER_SIZE) if ((frame_offset & 0x7fff) < FFM_HEADER_SIZE) {
ffm->packet_end = ffm->packet_ptr;
return -1; return -1;
}
ffm->packet_ptr = ffm->packet + (frame_offset & 0x7fff) - FFM_HEADER_SIZE; ffm->packet_ptr = ffm->packet + (frame_offset & 0x7fff) - FFM_HEADER_SIZE;
if (!header) if (!header)
break; break;