highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

matroska: don't overwrite string values until read/alloc was succesful.

Browse Source 
This prevents certain tags with a default value assigned to them (as per
the EBML syntax elements) from ever being assigned a NULL value. Other
parts of the code rely on these being non-NULL (i.e. they don't check for
NULL before e.g. using the string in strcmp() or similar), and thus in
effect this prevents crashes when reading of such specific tags fails,
either because of low memory or because of targeted file corruption.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit cd40c31ee9)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
This commit is contained in:
Ronald S. Bultje
2012-02-24 16:12:18 -08:00
committed by Reinhard Tartler
parent dd7b323d9a
commit 6c12293f6c
1 changed files with 8 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
libavformat/matroskadec.c
View File

@@ -636,16 +636,19 @@ static int ebml_read_float(AVIOContext *pb, int size, double *num)
*/ */
static int ebml_read_ascii(AVIOContext *pb, int size, char **str) static int ebml_read_ascii(AVIOContext *pb, int size, char **str)
{ {
av_free(*str); char *res;
/* EBML strings are usually not 0-terminated, so we allocate one /* EBML strings are usually not 0-terminated, so we allocate one
* byte more, read the string and NULL-terminate it ourselves. */ * byte more, read the string and NULL-terminate it ourselves. */
if (!(*str = av_malloc(size + 1))) if (!(res = av_malloc(size + 1)))
return AVERROR(ENOMEM); return AVERROR(ENOMEM);
if (avio_read(pb, (uint8_t *) *str, size) != size) { if (avio_read(pb, (uint8_t *) res, size) != size) {
av_freep(str); av_free(res);
return AVERROR(EIO); return AVERROR(EIO);
} }
(*str)[size] = '\0'; (res)[size] = '\0';
av_free(*str);
*str = res;
return 0; return 0;
} }