From a2d1d216291fd8c1f4a8b3bad4f0b50c084ba96d Mon Sep 17 00:00:00 2001 From: Janne Grunau Date: Tue, 3 Jan 2012 18:11:36 +0100 Subject: [PATCH] avio: exit early in fill_buffer without read_packet Fixes an invalid free() with ass in avi. The sample in bug 98 passes parts of AVPacket.data as buffer for the AVIOContext. Since the packet is quite large fill_buffer tries to reallocate the buffer before doing nothing. Fixes bug 98. --- libavformat/aviobuf.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavformat/aviobuf.c b/libavformat/aviobuf.c index 898f35d903..dbbbba5535 100644 --- a/libavformat/aviobuf.c +++ b/libavformat/aviobuf.c @@ -565,6 +565,10 @@ static void fill_buffer(AVIOContext *s) int len= s->buffer_size - (dst - s->buffer); int max_buffer_size = s->max_packet_size ? s->max_packet_size : IO_BUFFER_SIZE; + /* can't fill the buffer without read_packet, just set EOF if appropiate */ + if (!s->read_packet && s->buf_ptr >= s->buf_end) + s->eof_reached = 1; + /* no need to do anything if EOF already reached */ if (s->eof_reached) return;