[FFmpeg-devel] [PATCH] avformat/matroskadec: Prevent access of elements after freeing by set nb_elem to zero.

[Schenk, Michael]

Hi folks,

retry, because my eMail address was changed.

I’m using the decode interrupt feature of ffmpeg for getting a fast user reaction. It looks like this may causing some nasty
crashes by accessing previous freed pointers in matroska_read_close. The attached patch will reset nb_elem to zero after freeing the elements
because ffmpeg normally tests for nb_element.

Feedback for sure is warmly welcome.

Regards

Michael


---
Albis Technologies AG, Albisriederstrasse 199, CH-8047 Zürich, SWITZERLAND

Sitz der Gesellschaft / Domicile: Zürich
MWSt.-Nr. / VAT ID no.: CHE-114.433.653 MWST


ELCON Systemtechnik GmbH, Obere Hauptstrasse 10, D-09232 Hartmannsdorf, GERMANY

Sitz der Gesellschaft / Head office: Hartmannsdorf
Amtsgericht / County court: Chemnitz HRB 1 34 74
USt-ID-Nr. / VAT ID no.: DE 137 182 638
WEEE-Reg.-Nr. / WEEE Reg. no.: DE 35 781 658
Geschäftsführer / Managing director: Werner Neubauer, Markus Königshofer




Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte Informationen. Wenn Sie nicht der richtige Adressat sind oder diese E-Mail irrtümlich erhalten haben,
informieren Sie bitte sofort den Absender und vernichten Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Mail ist nicht gestattet.

This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender
immediately and destroy this e-mail. Any unauthorised copying, disclosure or distribution of the material in this e-mail is strictly forbidden.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-set-nb_elem-to-0-after-freeing-to-avoid-further-acce.patch
Type: application/octet-stream
Size: 906 bytes
Desc: 0001-set-nb_elem-to-0-after-freeing-to-avoid-further-acce.patch
URL: <http://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20161125/fbcbbf3a/attachment.obj>