diff options
| author | Andreas Rheinhardt <andreas.rheinhardt@gmail.com> | 2019-04-20 01:03:15 +0300 |
|---|---|---|
| committer | Andreas Rheinhardt <andreas.rheinhardt@gmail.com> | 2020-07-03 15:13:50 +0300 |
| commit | af8d5aab74c1fac2280e1a0b1e52c09b7e92e8b1 (patch) | |
| tree | 90a0ae2967b7b35222033c774b64d03a8bd82864 /libavformat/mmf.c | |
| parent | eb892918778164ff0b7a398954109e5fc5bf8872 (diff) | |
lavf/webm_chunk: Fix NULL dereferencerelease/3.3
The earlier version of the webm_chunk muxer had several bugs:
1. If the first packet of an audio stream didn't have a PTS of zero,
then no chunk will be started before a packet is delivered to the
underlying Matroska/WebM muxer, i.e. the AVFormatContext used to write
these packets had a NULL as AVIOContext for output. This is behind the
crash in ticket #5752.
2. If an error happens during writing a packet, the underlyimg
Matroska/WebM muxer context is freed. This leads to a use-after-free
coupled with a double-free in webm_chunk_write_trailer (which supposes
that the underlying AVFormatContext is still valid).
3. Even when no error occurs at all, webm_chunk_write_trailer is still
buggy: After the underlying Matroska/WebM muxer has written its trailer,
ending the chunk implicitly flushes it again which is illegal at this
point.
These bugs have been fixed.
Fixes #5752.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 8c6ee7626bcce7c270360f33b60dc7ef99939fc3)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Diffstat (limited to 'libavformat/mmf.c')
0 files changed, 0 insertions, 0 deletions