From ab3fcd93fde5f876e5e6879a2b78e8cbcde98ab5 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Fri, 13 Apr 2012 11:52:19 +0200 Subject: [PATCH] mov: zero extradata_size on deallocation of extradata. This prevents the possibility of extradata and its size becoming desynced. Signed-off-by: Michael Niedermayer --- libavformat/mov.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavformat/mov.c b/libavformat/mov.c index ce61250eac..d3bd2280a2 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -851,6 +851,7 @@ static int mov_read_smi(MOVContext *c, AVIOContext *pb, MOVAtom atom) // currently SVQ3 decoder expect full STSD header - so let's fake it // this should be fixed and just SMI header should be passed av_free(st->codec->extradata); + st->codec->extradata_size = 0; st->codec->extradata = av_mallocz(atom.size + 0x5a + FF_INPUT_BUFFER_PADDING_SIZE); if (!st->codec->extradata) return AVERROR(ENOMEM); @@ -987,6 +988,7 @@ static int mov_read_wave(MOVContext *c, AVIOContext *pb, MOVAtom atom) if (st->codec->codec_id == CODEC_ID_QDM2 || st->codec->codec_id == CODEC_ID_QDMC) { // pass all frma atom to codec, needed at least for QDMC and QDM2 av_free(st->codec->extradata); + st->codec->extradata_size = 0; st->codec->extradata = av_mallocz(atom.size + FF_INPUT_BUFFER_PADDING_SIZE); if (!st->codec->extradata) return AVERROR(ENOMEM); @@ -1026,6 +1028,7 @@ static int mov_read_glbl(MOVContext *c, AVIOContext *pb, MOVAtom atom) return mov_read_default(c, pb, atom); } av_free(st->codec->extradata); + st->codec->extradata_size = 0; st->codec->extradata = av_mallocz(atom.size + FF_INPUT_BUFFER_PADDING_SIZE); if (!st->codec->extradata) return AVERROR(ENOMEM); @@ -1051,6 +1054,7 @@ static int mov_read_dvc1(MOVContext *c, AVIOContext *pb, MOVAtom atom) return 0; av_free(st->codec->extradata); + st->codec->extradata_size = 0; st->codec->extradata = av_mallocz(atom.size - 7 + FF_INPUT_BUFFER_PADDING_SIZE); if (!st->codec->extradata) return AVERROR(ENOMEM); @@ -1079,6 +1083,7 @@ static int mov_read_strf(MOVContext *c, AVIOContext *pb, MOVAtom atom) return AVERROR_INVALIDDATA; av_free(st->codec->extradata); + st->codec->extradata_size = 0; st->codec->extradata = av_mallocz(atom.size - 40 + FF_INPUT_BUFFER_PADDING_SIZE); if (!st->codec->extradata) return AVERROR(ENOMEM);