From f35e037c93cf7d25e65b4a2ed3674358f05e4bed Mon Sep 17 00:00:00 2001 From: Chris Evans Date: Wed, 4 Jan 2012 16:33:34 +0100 Subject: [PATCH] mkv: Fix a bug where a pointer was cached to an array that might later move due to a realloc() BUG=100492 Review URL: http://codereview.chromium.org/8366004 Fixes: 1 of 2 for CVE-2011-3893 Signed-off-by: Michael Niedermayer --- libavformat/matroskadec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c index fd1001ef8e..600b1f4c60 100644 --- a/libavformat/matroskadec.c +++ b/libavformat/matroskadec.c @@ -1223,7 +1223,6 @@ static int matroska_parse_seekhead_entry(MatroskaDemuxContext *matroska, int idx static void matroska_execute_seekhead(MatroskaDemuxContext *matroska) { EbmlList *seekhead_list = &matroska->seekhead; - MatroskaSeekhead *seekhead = seekhead_list->elem; int64_t before_pos = avio_tell(matroska->ctx->pb); int i; @@ -1233,6 +1232,7 @@ static void matroska_execute_seekhead(MatroskaDemuxContext *matroska) return; for (i = 0; i < seekhead_list->nb_elem; i++) { + MatroskaSeekhead *seekhead = seekhead_list->elem; if (seekhead[i].pos <= before_pos) continue;