← Back to branch summary

~ubuntu-branches/ubuntu/raring/libav/raring-security

« back to all changes in this revision

Viewing changes to debian/patches/post-0.7.1/0062-oggdec-fix-out-of-bound-write-in-the-ogg-demuxer.patch

  • Committer: Package Import Robot
  • Author(s): Reinhard Tartler
  • Date: 2011-10-01 00:22:07 UTC
  • mfrom: (1.3.8 sid)
  • Revision ID: package-import@ubuntu.com-20111001002207-tnxz39i0rwr5ufy9
Tags: 4:0.7.2-1ubuntu1
* Merge from debian, remaining changes:
  - don't build against libfaad, libdirac, librtmp and libopenjpeg,
    lame, xvid, x264  (all in universe)
  - not installing into multiarch directories
* This new upstream release has basically merged in all 70 patches that
  are present in 4:0.7.1-7ubuntu2, plus some additional, similarily
  focused ones.

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches/post-0.7.1/0062-oggdec-fix-out-of-bound-write-in-the-ogg-demuxer.patch
1
 
From a3d471e500674c31fa4f52a62ef789d5e7fdbd3c Mon Sep 17 00:00:00 2001
2
 
From: Laurent Aimar <fenrir@videolan.org>
3
 
Date: Sun, 11 Sep 2011 23:26:12 +0200
4
 
Subject: [PATCH 62/70] oggdec: fix out of bound write in the ogg demuxer
5
 
 
6
 
Between ogg_save() and ogg_restore() calls, the number of streams
7
 
could have been reduced.
8
 
 
9
 
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
10
 
(cherry picked from commit 0e7efb9d23c3641d50caa288818e8c27647ce74d)
11
 
 
12
 
Signed-off-by: Anton Khirnov <anton@khirnov.net>
13
 
---
14
 
 libavformat/oggdec.c |   14 ++++++++++++--
15
 
 1 files changed, 12 insertions(+), 2 deletions(-)
16
 
 
17
 
diff --git a/libavformat/oggdec.c b/libavformat/oggdec.c
18
 
index 25f5cd8..1820167 100644
19
 
--- a/libavformat/oggdec.c
20
 
+++ b/libavformat/oggdec.c
21
 
@@ -92,14 +92,24 @@ static int ogg_restore(AVFormatContext *s, int discard)
22
 
     ogg->state = ost->next;
23
 
 
24
 
     if (!discard){
25
 
+        struct ogg_stream *old_streams = ogg->streams;
26
 
+
27
 
         for (i = 0; i < ogg->nstreams; i++)
28
 
             av_free (ogg->streams[i].buf);
29
 
 
30
 
         avio_seek (bc, ost->pos, SEEK_SET);
31
 
         ogg->curidx = ost->curidx;
32
 
         ogg->nstreams = ost->nstreams;
33
 
-        memcpy(ogg->streams, ost->streams,
34
 
-               ost->nstreams * sizeof(*ogg->streams));
35
 
+        ogg->streams = av_realloc (ogg->streams,
36
 
+                                   ogg->nstreams * sizeof (*ogg->streams));
37
 
+
38
 
+        if (ogg->streams) {
39
 
+            memcpy(ogg->streams, ost->streams,
40
 
+                   ost->nstreams * sizeof(*ogg->streams));
41
 
+        } else {
42
 
+            av_free(old_streams);
43
 
+            ogg->nstreams = 0;
44
 
+        }
45
 
     }
46
 
 
47
 
     av_free (ost);
48
 
1.7.4.1
49