On Sat, Jan 02, 2016 at 04:51:17PM +0100, Andreas Cadhalpun wrote: > This fixes segmentation faults caused by passing a packet_ptr of NULL to > memcpy. > > Signed-off-by: Andreas Cadhalpun <[email protected]> > --- > libavformat/ffmdec.c | 8 ++++++-- > 1 file changed, 6 insertions(+), 2 deletions(-) > > diff --git a/libavformat/ffmdec.c b/libavformat/ffmdec.c > index 9fe4155..7b2d0d7 100644 > --- a/libavformat/ffmdec.c > +++ b/libavformat/ffmdec.c > @@ -123,8 +123,10 @@ static int ffm_read_data(AVFormatContext *s, > frame_offset = avio_rb16(pb); > avio_read(pb, ffm->packet, ffm->packet_size - FFM_HEADER_SIZE); > ffm->packet_end = ffm->packet + (ffm->packet_size - > FFM_HEADER_SIZE - fill_size); > - if (ffm->packet_end < ffm->packet || frame_offset < 0) > + if (ffm->packet_end < ffm->packet || frame_offset < 0) { > + ffm->packet_end = ffm->packet_ptr;
doesnt this imply that packet_end was set to a invalid pointer?
(that is undefined behavior)
> return -1;
> + }
> /* if first packet or resynchronization packet, we must
> handle it specifically */
> if (ffm->first_packet || (frame_offset & 0x8000)) {
> @@ -140,8 +142,10 @@ static int ffm_read_data(AVFormatContext *s,
> return 0;
> }
> ffm->first_packet = 0;
> - if ((frame_offset & 0x7fff) < FFM_HEADER_SIZE)
> + if ((frame_offset & 0x7fff) < FFM_HEADER_SIZE) {
> + ffm->packet_end = ffm->packet_ptr;
> return -1;
> + }
> ffm->packet_ptr = ffm->packet + (frame_offset & 0x7fff) -
> FFM_HEADER_SIZE;
> if (!header)
> break;
> --
> 2.6.4
> _______________________________________________
> ffmpeg-devel mailing list
> [email protected]
> http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
--
Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB
Those who are too smart to engage in politics are punished by being
governed by those who are dumber. -- Plato
signature.asc
Description: Digital signature
_______________________________________________ ffmpeg-devel mailing list [email protected] http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
