summaryrefslogtreecommitdiff
path: root/libavformat/nsvdec.c
diff options
context:
space:
mode:
authorMichael Niedermayer <michaelni@gmx.at>2012-01-24 22:20:26 +0100
committerMichael Niedermayer <michaelni@gmx.at>2012-01-25 06:48:30 +0100
commit5c011706bc752d34bc6ada31d7df2ca0c9af7c6b (patch)
tree6d3755485ec96c65f9c0f93fe9ef94e3539de2d8 /libavformat/nsvdec.c
parent7988dd1b9a1a5013a77d90cb7105c8a83d836756 (diff)
nsvdec: Fix use of uninitialized streams.
Fixes CVE-2011-3940 (Out of bounds read resulting in out of bounds write) Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat/nsvdec.c')
-rw-r--r--libavformat/nsvdec.c8
1 files changed, 4 insertions, 4 deletions
diff --git a/libavformat/nsvdec.c b/libavformat/nsvdec.c
index 76bcd4a5ea..6a6830ee9f 100644
--- a/libavformat/nsvdec.c
+++ b/libavformat/nsvdec.c
@@ -606,12 +606,12 @@ null_chunk_retry:
}
/* map back streams to v,a */
- if (s->streams[0])
+ if (s->nb_streams > 0)
st[s->streams[0]->id] = s->streams[0];
- if (s->streams[1])
+ if (s->nb_streams > 1)
st[s->streams[1]->id] = s->streams[1];
- if (vsize/* && st[NSV_ST_VIDEO]*/) {
+ if (vsize && st[NSV_ST_VIDEO]) {
nst = st[NSV_ST_VIDEO]->priv_data;
pkt = &nsv->ahead[NSV_ST_VIDEO];
av_get_packet(pb, pkt, vsize);
@@ -624,7 +624,7 @@ null_chunk_retry:
if(st[NSV_ST_VIDEO])
((NSVStream*)st[NSV_ST_VIDEO]->priv_data)->frame_offset++;
- if (asize/*st[NSV_ST_AUDIO]*/) {
+ if (asize && st[NSV_ST_AUDIO]) {
nst = st[NSV_ST_AUDIO]->priv_data;
pkt = &nsv->ahead[NSV_ST_AUDIO];
/* read raw audio specific header on the first audio chunk... */