diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-12-05 07:38:57 +0400 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-12-05 07:40:19 +0400 |
| commit | 9db3fb6ed8d35ae02a1d3c322777bd45bb4579c9 (patch) | |
| tree | 8279d2a5fca992c501a15d7eceec4e2148742656 /libavformat/oggdec.c | |
| parent | 599ae9995f2e66803431e9d87fab2e650f23229e (diff) | |
oggdec: prevent codec from changing through ogg_replace_stream()
This prevents inconsistencies leading to out of array accesses.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat/oggdec.c')
| -rw-r--r-- | libavformat/oggdec.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/libavformat/oggdec.c b/libavformat/oggdec.c index 3ca33dcb63..11645c945d 100644 --- a/libavformat/oggdec.c +++ b/libavformat/oggdec.c @@ -174,6 +174,7 @@ static int ogg_replace_stream(AVFormatContext *s, uint32_t serial) struct ogg_stream *os; unsigned bufsize; uint8_t *buf; + struct ogg_codec *codec; if (ogg->nstreams != 1) { av_log_missing_feature(s, "Changing stream parameters in multistream ogg", 0); @@ -184,6 +185,7 @@ static int ogg_replace_stream(AVFormatContext *s, uint32_t serial) buf = os->buf; bufsize = os->bufsize; + codec = os->codec; if (!ogg->state || ogg->state->streams[0].private != os->private) av_freep(&ogg->streams[0].private); @@ -195,6 +197,7 @@ static int ogg_replace_stream(AVFormatContext *s, uint32_t serial) os->bufsize = bufsize; os->buf = buf; os->header = -1; + os->codec = codec; return 0; } |