Chiebot-Mirror
/
FFmpeg
mirror of https://github.com/FFmpeg/FFmpeg.git
8
0
Fork 0
Code Issues Projects Releases Wiki Activity

nsvdec: Fix use of uninitialized streams.

Browse Source 
Fixes CVE-2011-3940 (Out of bounds read resulting in out of bounds write)

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
release/0.10
Michael Niedermayer 13 years ago
parent 7988dd1b9a
commit 5c011706bc
1 changed files with 4 additions and 4 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Unified View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 8
      libavformat/nsvdec.c

8
libavformat/nsvdec.c
Unescape View File

@ -606,12 +606,12 @@ null_chunk_retry:
} }
/* map back streams to v,a */ /* map back streams to v,a */
if (s->streams[0]) if (s->nb_streams > 0)
st[s->streams[0]->id] = s->streams[0]; st[s->streams[0]->id] = s->streams[0];
if (s->streams[1]) if (s->nb_streams > 1)
st[s->streams[1]->id] = s->streams[1]; st[s->streams[1]->id] = s->streams[1];
if (vsize/* && st[NSV_ST_VIDEO]*/) { if (vsize && st[NSV_ST_VIDEO]) {
nst = st[NSV_ST_VIDEO]->priv_data; nst = st[NSV_ST_VIDEO]->priv_data;
pkt = &nsv->ahead[NSV_ST_VIDEO]; pkt = &nsv->ahead[NSV_ST_VIDEO];
av_get_packet(pb, pkt, vsize); av_get_packet(pb, pkt, vsize);
@ -624,7 +624,7 @@ null_chunk_retry:
if(st[NSV_ST_VIDEO]) if(st[NSV_ST_VIDEO])
((NSVStream*)st[NSV_ST_VIDEO]->priv_data)->frame_offset++; ((NSVStream*)st[NSV_ST_VIDEO]->priv_data)->frame_offset++;
if (asize/*st[NSV_ST_AUDIO]*/) { if (asize && st[NSV_ST_AUDIO]) {
nst = st[NSV_ST_AUDIO]->priv_data; nst = st[NSV_ST_AUDIO]->priv_data;
pkt = &nsv->ahead[NSV_ST_AUDIO]; pkt = &nsv->ahead[NSV_ST_AUDIO];
/* read raw audio specific header on the first audio chunk... */ /* read raw audio specific header on the first audio chunk... */

Write Preview
Loading…
Cancel
Save