[FFmpeg-cvslog] asfdec: only set asf_pkt->data_size after sanity checks
Andreas Cadhalpun
git at videolan.org
Tue Jan 19 08:45:46 CET 2016
ffmpeg | branch: master | Andreas Cadhalpun <andreas.cadhalpun at googlemail.com> | Wed Jan 6 07:34:42 2016 +0100| [c69461d73797e02e7a3ab4316050c241fa91f53f] | committer: Anton Khirnov
asfdec: only set asf_pkt->data_size after sanity checks
Otherwise invalid values are used unchecked in the next run.
This can cause NULL pointer dereferencing.
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun at googlemail.com>
Signed-off-by: Alexandra Hájková <alexandra.khirnova at gmail.com>
Signed-off-by: Anton Khirnov <anton at khirnov.net>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c69461d73797e02e7a3ab4316050c241fa91f53f
---
libavformat/asfdec.c | 18 ++++++++++--------
1 file changed, 10 insertions(+), 8 deletions(-)
diff --git a/libavformat/asfdec.c b/libavformat/asfdec.c
index ca7712f..58480dc 100644
--- a/libavformat/asfdec.c
+++ b/libavformat/asfdec.c
@@ -1136,14 +1136,15 @@ static int asf_read_replicated_data(AVFormatContext *s, ASFPacket *asf_pkt)
{
ASFContext *asf = s->priv_data;
AVIOContext *pb = s->pb;
- int ret;
+ int ret, data_size;
if (!asf_pkt->data_size) {
- asf_pkt->data_size = asf_pkt->size_left = avio_rl32(pb); // read media object size
- if (asf_pkt->data_size <= 0)
+ data_size = avio_rl32(pb); // read media object size
+ if (data_size <= 0)
return AVERROR_INVALIDDATA;
- if ((ret = av_new_packet(&asf_pkt->avpkt, asf_pkt->data_size)) < 0)
+ if ((ret = av_new_packet(&asf_pkt->avpkt, data_size)) < 0)
return ret;
+ asf_pkt->data_size = asf_pkt->size_left = data_size;
} else
avio_skip(pb, 4); // reading of media object size is already done
asf_pkt->dts = avio_rl32(pb); // read presentation time
@@ -1212,14 +1213,15 @@ static int asf_read_single_payload(AVFormatContext *s, AVPacket *pkt,
int64_t offset;
uint64_t size;
unsigned char *p;
- int ret;
+ int ret, data_size;
if (!asf_pkt->data_size) {
- asf_pkt->data_size = asf_pkt->size_left = avio_rl32(pb); // read media object size
- if (asf_pkt->data_size <= 0)
+ data_size = avio_rl32(pb); // read media objectgg size
+ if (data_size <= 0)
return AVERROR_EOF;
- if ((ret = av_new_packet(&asf_pkt->avpkt, asf_pkt->data_size)) < 0)
+ if ((ret = av_new_packet(&asf_pkt->avpkt, data_size)) < 0)
return ret;
+ asf_pkt->data_size = asf_pkt->size_left = data_size;
} else
avio_skip(pb, 4); // skip media object size
asf_pkt->dts = avio_rl32(pb); // read presentation time
More information about the ffmpeg-cvslog
mailing list