RepoMirrors/mpv
1
0
Fork 0
mirror of https://github.com/mpv-player/mpv synced 2025-02-16 12:17:12 +00:00
Code Issues Releases Wiki Activity

lavc_conv: fix invalid write

Browse Source 
Well shit. Restructure it such that the returned list is always NULL-
terminated with the same mechanism.
This commit is contained in:
wm4 2015-12-19 21:21:36 +01:00
parent 0a0bb9059f
commit c01935986c
1 changed files with 2 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
sub/lavc_conv.c
View File

@ -232,9 +232,9 @@ char **lavc_conv_decode(struct lavc_conv *priv, struct demux_packet *packet)
AVPacket pkt; AVPacket pkt;
AVPacket parsed_pkt = {0}; AVPacket parsed_pkt = {0};
int ret, got_sub; int ret, got_sub;
int num_cur = 0;
avsubtitle_free(&priv->cur); avsubtitle_free(&priv->cur);
priv->cur_list[0] = NULL;
mp_set_av_packet(&pkt, packet, &avctx->time_base); mp_set_av_packet(&pkt, packet, &avctx->time_base);
@ -250,7 +250,6 @@ char **lavc_conv_decode(struct lavc_conv *priv, struct demux_packet *packet)
if (ret < 0) { if (ret < 0) {
MP_ERR(priv, "Error decoding subtitle\n"); MP_ERR(priv, "Error decoding subtitle\n");
} else if (got_sub) { } else if (got_sub) {
int num_cur = 0;
for (int i = 0; i < priv->cur.num_rects; i++) { for (int i = 0; i < priv->cur.num_rects; i++) {
if (priv->cur.rects[i]->w > 0 && priv->cur.rects[i]->h > 0) if (priv->cur.rects[i]->w > 0 && priv->cur.rects[i]->h > 0)
MP_WARN(priv, "Ignoring bitmap subtitle.\n"); MP_WARN(priv, "Ignoring bitmap subtitle.\n");
@ -259,11 +258,11 @@ char **lavc_conv_decode(struct lavc_conv *priv, struct demux_packet *packet)
continue; continue;
MP_TARRAY_APPEND(priv, priv->cur_list, num_cur, ass_line); MP_TARRAY_APPEND(priv, priv->cur_list, num_cur, ass_line);
} }
MP_TARRAY_APPEND(priv, priv->cur_list, num_cur, NULL);
} }
done: done:
av_packet_unref(&parsed_pkt); av_packet_unref(&parsed_pkt);
MP_TARRAY_APPEND(priv, priv->cur_list, num_cur, NULL);
return priv->cur_list; return priv->cur_list;
} }