[FFmpeg-devel] [PATCH] avformat/asfdec_f: init avpacket by av_packet_alloc()
yshaw1999 at 163.com
yshaw1999 at 163.com
Tue Jan 11 15:40:38 EET 2022
From: Yang Xiao <yshaw99 at outlook.com>
Pointer member side_data of AVPacket that allocated by stack may be wild pointer.
Prevent releasing wild pointers in AVPacket when some functions try to call av_packet_unref()
---
libavformat/asfdec_f.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/libavformat/asfdec_f.c b/libavformat/asfdec_f.c
index a8f36ed286..605d9f53a1 100644
--- a/libavformat/asfdec_f.c
+++ b/libavformat/asfdec_f.c
@@ -1433,7 +1433,9 @@ static int64_t asf_read_pts(AVFormatContext *s, int stream_index,
{
FFFormatContext *const si = ffformatcontext(s);
ASFContext *asf = s->priv_data;
- AVPacket pkt1, *pkt = &pkt1;
+ AVPacket *pkt = av_packet_alloc();
+ if(!pkt)
+ return AVERROR(ENOMEM);
ASFStream *asf_st;
int64_t pts;
int64_t pos = *ppos;
@@ -1448,13 +1450,16 @@ static int64_t asf_read_pts(AVFormatContext *s, int stream_index,
s->packet_size * s->packet_size +
si->data_offset;
*ppos = pos;
- if (avio_seek(s->pb, pos, SEEK_SET) < 0)
+ if (avio_seek(s->pb, pos, SEEK_SET) < 0) {
+ av_packet_free(&pkt);
return AV_NOPTS_VALUE;
+ }
ff_read_frame_flush(s);
asf_reset_header(s);
for (;;) {
if (av_read_frame(s, pkt) < 0) {
+ av_packet_free(&pkt);
av_log(s, AV_LOG_INFO, "asf_read_pts failed\n");
return AV_NOPTS_VALUE;
}
@@ -1483,6 +1488,7 @@ static int64_t asf_read_pts(AVFormatContext *s, int stream_index,
}
*ppos = pos;
+ av_packet_free(&pkt);
return pts;
}
--
2.30.1 (Apple Git-130)
More information about the ffmpeg-devel
mailing list