[libav-commits] avio: exit early in fill_buffer without read_packet

Janne Grunau git at libav.org
Wed Jan 4 11:19:31 CET 2012


Module: libav
Branch: master
Commit: a2d1d216291fd8c1f4a8b3bad4f0b50c084ba96d

Author:    Janne Grunau <janne-libav at jannau.net>
Committer: Janne Grunau <janne-libav at jannau.net>
Date:      Tue Jan  3 18:11:36 2012 +0100

avio: exit early in fill_buffer without read_packet

Fixes an invalid free() with ass in avi. The sample in bug 98 passes
parts of AVPacket.data as buffer for the AVIOContext. Since the packet
is quite large fill_buffer tries to reallocate the buffer before doing
nothing. Fixes bug 98.

---

 libavformat/aviobuf.c |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

diff --git a/libavformat/aviobuf.c b/libavformat/aviobuf.c
index 898f35d..dbbbba5 100644
--- a/libavformat/aviobuf.c
+++ b/libavformat/aviobuf.c
@@ -565,6 +565,10 @@ static void fill_buffer(AVIOContext *s)
     int len= s->buffer_size - (dst - s->buffer);
     int max_buffer_size = s->max_packet_size ? s->max_packet_size : IO_BUFFER_SIZE;
 
+    /* can't fill the buffer without read_packet, just set EOF if appropiate */
+    if (!s->read_packet && s->buf_ptr >= s->buf_end)
+        s->eof_reached = 1;
+
     /* no need to do anything if EOF already reached */
     if (s->eof_reached)
         return;



More information about the libav-commits mailing list