har0ke/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

oggdec: check stream index before using it in ogg_get_length()

Browse Source 
Fixes crash based on a uninitialized array index read.
If the read does not crash then out of array writes based
on the same index might have been triggered afterwards.

Found-by: inferno@chromium.org
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2012-08-05 04:41:34 +02:00
parent 74c6db0505
commit 9e1c55cfde
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
libavformat/oggdec.c
View File

@ -525,7 +525,9 @@ static int ogg_get_length(AVFormatContext *s)
ogg_save (s); ogg_save (s);
avio_seek (s->pb, s->data_offset, SEEK_SET); avio_seek (s->pb, s->data_offset, SEEK_SET);
ogg_reset(s); ogg_reset(s);
i = -1;
while (!ogg_packet(s, &i, NULL, NULL, NULL)) { while (!ogg_packet(s, &i, NULL, NULL, NULL)) {
if(i>=0) {
int64_t pts = ogg_calc_pts(s, i, NULL); int64_t pts = ogg_calc_pts(s, i, NULL);
if (pts != AV_NOPTS_VALUE && s->streams[i]->start_time == AV_NOPTS_VALUE && !ogg->streams[i].got_start){ if (pts != AV_NOPTS_VALUE && s->streams[i]->start_time == AV_NOPTS_VALUE && !ogg->streams[i].got_start){
s->streams[i]->duration -= pts; s->streams[i]->duration -= pts;
@ -534,6 +536,7 @@ static int ogg_get_length(AVFormatContext *s)
}else if(s->streams[i]->start_time != AV_NOPTS_VALUE && !ogg->streams[i].got_start){ }else if(s->streams[i]->start_time != AV_NOPTS_VALUE && !ogg->streams[i].got_start){
ogg->streams[i].got_start= 1; ogg->streams[i].got_start= 1;
streams_left--; streams_left--;
}
} }
if(streams_left<=0) if(streams_left<=0)
break; break;