From fb9e9da0b360d6eb3ff960e276d9c225d83d4bb1 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Fri, 1 May 2020 14:34:18 +0200 Subject: avformat/oggdec: Reallocate buffer before writing into it Fixes: out of array write Fixes: Regression since f619e1ec66b89215582eff4404b681b760540b4f Reviewed-by: Lynne Signed-off-by: Michael Niedermayer --- libavformat/oggdec.c | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'libavformat') diff --git a/libavformat/oggdec.c b/libavformat/oggdec.c index a9034ea61c..7dd48af66c 100644 --- a/libavformat/oggdec.c +++ b/libavformat/oggdec.c @@ -441,6 +441,12 @@ static int ogg_read_page(AVFormatContext *s, int *sid, int probing) os = ogg->streams + idx; + ret = buf_realloc(os, size); + if (ret < 0) { + av_free(readout_buf); + return ret; + } + memcpy(os->buf + os->bufpos, readout_buf, size); av_free(readout_buf); } -- cgit v1.2.3