RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2025-03-04 11:38:19 +00:00
Code Issues Projects Releases Wiki Activity

reorganize matroska_add_stream() to fix potential mem leak and buffer overflow

Browse Source 
fix CID44

Originally committed as revision 13634 to svn://svn.ffmpeg.org/ffmpeg/trunk
This commit is contained in:
Aurelien Jacobs 2008-06-02 23:07:41 +00:00
parent 4b3dc529f5
commit fe53fa253f
1 changed files with 9 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
libavformat/matroskadec.c
View File

@ -1021,17 +1021,16 @@ matroska_add_stream (MatroskaDemuxContext *matroska)
uint32_t id; uint32_t id;
MatroskaTrack *track; MatroskaTrack *track;
/* start with the master */
if ((res = ebml_read_master(matroska, &id)) < 0)
return res;
av_log(matroska->ctx, AV_LOG_DEBUG, "parsing track, adding stream..,\n"); av_log(matroska->ctx, AV_LOG_DEBUG, "parsing track, adding stream..,\n");
/* Allocate a generic track. As soon as we know its type we'll realloc. */ /* Allocate a generic track. As soon as we know its type we'll realloc. */
track = av_mallocz(MAX_TRACK_SIZE); track = av_mallocz(MAX_TRACK_SIZE);
matroska->num_tracks++;
strcpy(track->language, "eng"); strcpy(track->language, "eng");
/* start with the master */
if ((res = ebml_read_master(matroska, &id)) < 0)
return res;
/* try reading the trackentry headers */ /* try reading the trackentry headers */
while (res == 0) { while (res == 0) {
if (!(id = ebml_peek_id(matroska, &matroska->level_up))) { if (!(id = ebml_peek_id(matroska, &matroska->level_up))) {
@ -1088,7 +1087,6 @@ matroska_add_stream (MatroskaDemuxContext *matroska)
track->type = MATROSKA_TRACK_TYPE_NONE; track->type = MATROSKA_TRACK_TYPE_NONE;
break; break;
} }
matroska->tracks[matroska->num_tracks - 1] = track;
break; break;
} }
@ -1623,6 +1621,11 @@ matroska_add_stream (MatroskaDemuxContext *matroska)
} }
} }
if (track->type && matroska->num_tracks < ARRAY_SIZE(matroska->tracks)) {
matroska->tracks[matroska->num_tracks++] = track;
} else {
av_free(track);
}
return res; return res;
} }