[FFmpeg-cvslog] oggdec: check stream index before using it in ogg_get_length()

[Michael Niedermayer]

ffmpeg | branch: release/0.11 | Michael Niedermayer <michaelni at gmx.at> | Sun Aug  5 04:41:34 2012 +0200| [606538df6c05df51aa811cef0c0bccb7499cc4a1] | committer: Michael Niedermayer

oggdec: check stream index before using it in ogg_get_length()

Fixes crash based on a uninitialized array index read.
If the read does not crash then out of array writes based
on the same index might have been triggered afterwards.

Found-by: inferno at chromium.org
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
(cherry picked from commit 9e1c55cfdec1e1e46fa39b92ea5c425ba9499c68)

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=606538df6c05df51aa811cef0c0bccb7499cc4a1
---

 libavformat/oggdec.c |    3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavformat/oggdec.c b/libavformat/oggdec.c
index d30c17c..6df4831 100644
--- a/libavformat/oggdec.c
+++ b/libavformat/oggdec.c
@@ -524,7 +524,9 @@ static int ogg_get_length(AVFormatContext *s)
     ogg_save (s);
     avio_seek (s->pb, s->data_offset, SEEK_SET);
     ogg_reset(s);
+    i = -1;
     while (!ogg_packet(s, &i, NULL, NULL, NULL)) {
+        if(i>=0) {
         int64_t pts = ogg_calc_pts(s, i, NULL);
         if (pts != AV_NOPTS_VALUE && s->streams[i]->start_time == AV_NOPTS_VALUE && !ogg->streams[i].got_start){
             s->streams[i]->duration -= pts;
@@ -534,6 +536,7 @@ static int ogg_get_length(AVFormatContext *s)
             ogg->streams[i].got_start= 1;
             streams_left--;
         }
+        }
             if(streams_left<=0)
                 break;
     }