From 9bb3b7d028395a8fe70148dec89430e8aae7a7e2 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 17 Apr 2012 14:03:26 +0200 Subject: [PATCH] oggdec: Recreate streams only in the 1 stream case. Other cases are not supported and lead to inconsistencies which can lead to out of array writes. Reported-by: Dale Curtis Signed-off-by: Michael Niedermayer --- libavformat/oggdec.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavformat/oggdec.c b/libavformat/oggdec.c index bdd2c5ba77..ab523790ec 100644 --- a/libavformat/oggdec.c +++ b/libavformat/oggdec.c @@ -247,6 +247,9 @@ static int ogg_read_page(AVFormatContext *s, int *str) if (ogg->headers) { int n; + if (ogg->nstreams != 1) + return idx; + for (n = 0; n < ogg->nstreams; n++) { av_freep(&ogg->streams[n].buf); if (!ogg->state || ogg->state->streams[n].private != ogg->streams[n].private)