History

Fix memory corruption in case of memory allocation failure in av_probe_input_buffer()

Michael Niedermayer committed 15 years ago

Commit 941bb551 parent 24ddfb21 file · +7 −1Browse files

Unified · Split

libavformat/utils.c+7−1
@@ -527,13 +527,19 @@ int av_probe_input_buffer(AVIOContext *pb, AVInputFormat **fmt, · 526 unmodified lines
527 probe_size = FFMIN(probe_size<<1, FFMAX(max_probe_size, probe_size+1))) {527 probe_size = FFMIN(probe_size<<1, FFMAX(max_probe_size, probe_size+1))) {
528 int score = probe_size < max_probe_size ? AVPROBE_SCORE_MAX/4 : 0;528 int score = probe_size < max_probe_size ? AVPROBE_SCORE_MAX/4 : 0;
529 int buf_offset = (probe_size == PROBE_BUF_MIN) ? 0 : probe_size>>1;529 int buf_offset = (probe_size == PROBE_BUF_MIN) ? 0 : probe_size>>1;
530 void *buftmp;
530 531
531 if (probe_size < offset) {532 if (probe_size < offset) {
532 continue;533 continue;
533 }534 }
534 535
535 /* read probe data */536 /* read probe data */
536 buf = av_realloc(buf, probe_size + AVPROBE_PADDING_SIZE);537 buftmp = av_realloc(buf, probe_size + AVPROBE_PADDING_SIZE);
538 if(!buftmp){
539 av_free(buf);
540 return AVERROR(ENOMEM);
541 }
542 buf=buftmp;
537 if ((ret = avio_read(pb, buf + buf_offset, probe_size - buf_offset)) < 0) {543 if ((ret = avio_read(pb, buf + buf_offset, probe_size - buf_offset)) < 0) {
538 /* fail if error was not end of file, otherwise, lower score */544 /* fail if error was not end of file, otherwise, lower score */
539 if (ret != AVERROR_EOF) {545 if (ret != AVERROR_EOF) {

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t