mirror of https://git.ffmpeg.org/ffmpeg.git
mkv: Fix a bug where a pointer was cached to an array that might later move due to
a realloc() BUG=100492 Review URL: http://codereview.chromium.org/8366004 Fixes: 1 of 2 for CVE-2011-3893 Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
parent
f0f2babca2
commit
f35e037c93
|
@ -1223,7 +1223,6 @@ static int matroska_parse_seekhead_entry(MatroskaDemuxContext *matroska, int idx
|
||||||
static void matroska_execute_seekhead(MatroskaDemuxContext *matroska)
|
static void matroska_execute_seekhead(MatroskaDemuxContext *matroska)
|
||||||
{
|
{
|
||||||
EbmlList *seekhead_list = &matroska->seekhead;
|
EbmlList *seekhead_list = &matroska->seekhead;
|
||||||
MatroskaSeekhead *seekhead = seekhead_list->elem;
|
|
||||||
int64_t before_pos = avio_tell(matroska->ctx->pb);
|
int64_t before_pos = avio_tell(matroska->ctx->pb);
|
||||||
int i;
|
int i;
|
||||||
|
|
||||||
|
@ -1233,6 +1232,7 @@ static void matroska_execute_seekhead(MatroskaDemuxContext *matroska)
|
||||||
return;
|
return;
|
||||||
|
|
||||||
for (i = 0; i < seekhead_list->nb_elem; i++) {
|
for (i = 0; i < seekhead_list->nb_elem; i++) {
|
||||||
|
MatroskaSeekhead *seekhead = seekhead_list->elem;
|
||||||
if (seekhead[i].pos <= before_pos)
|
if (seekhead[i].pos <= before_pos)
|
||||||
continue;
|
continue;
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue