[libav-commits] matroskadec: Fix a bug where a pointer was cached to an array that might later move due to a realloc ()

Chris Evans git at libav.org
Thu Jan 5 21:55:08 CET 2012


Module: libav
Branch: master
Commit: faaec4676cb4c7a2303d50df66c6290bc96a7657

Author:    Chris Evans <cevans at chromium.org>
Committer: Reinhard Tartler <siretart at tauware.de>
Date:      Thu Jan  5 21:19:30 2012 +0100

matroskadec: Fix a bug where a pointer was cached to an array that might later move due to a realloc()

Fixes bug #190
Chromium bug #100492
related to CVE-2011-3893

Signed-off-by: Reinhard Tartler <siretart at tauware.de>

---

 libavformat/matroskadec.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c
index 2684d6e..e5fbd43 100644
--- a/libavformat/matroskadec.c
+++ b/libavformat/matroskadec.c
@@ -1188,7 +1188,6 @@ static int matroska_parse_seekhead_entry(MatroskaDemuxContext *matroska, int idx
 static void matroska_execute_seekhead(MatroskaDemuxContext *matroska)
 {
     EbmlList *seekhead_list = &matroska->seekhead;
-    MatroskaSeekhead *seekhead = seekhead_list->elem;
     int64_t before_pos = avio_tell(matroska->ctx->pb);
     int i;
 
@@ -1198,6 +1197,7 @@ static void matroska_execute_seekhead(MatroskaDemuxContext *matroska)
         return;
 
     for (i = 0; i < seekhead_list->nb_elem; i++) {
+        MatroskaSeekhead *seekhead = seekhead_list->elem;
         if (seekhead[i].pos <= before_pos)
             continue;
 



More information about the libav-commits mailing list