diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-03-23 03:43:30 +0100 |
|---|---|---|
| committer | Luca Barbato <lu_zero@gentoo.org> | 2012-09-24 22:35:29 +0200 |
| commit | bb146bb57bea6647f9c080aa4f9323a3a789ad22 (patch) | |
| tree | 801001f6f0287891ffea4cef39c21e33b25f4f5a /libavformat/oggparsetheora.c | |
| parent | d1f05dd18375f2f8e68372edee11436927e43ba8 (diff) | |
ogg: prevent NULL pointer deference in theora gptopts
Additional safety in case a special ogg stream is crafted
with the proper number of
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat/oggparsetheora.c')
| -rw-r--r-- | libavformat/oggparsetheora.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/libavformat/oggparsetheora.c b/libavformat/oggparsetheora.c index df7a89c09d..632c4ef521 100644 --- a/libavformat/oggparsetheora.c +++ b/libavformat/oggparsetheora.c @@ -131,8 +131,13 @@ theora_gptopts(AVFormatContext *ctx, int idx, uint64_t gp, int64_t *dts) struct ogg *ogg = ctx->priv_data; struct ogg_stream *os = ogg->streams + idx; struct theora_params *thp = os->private; - uint64_t iframe = gp >> thp->gpshift; - uint64_t pframe = gp & thp->gpmask; + uint64_t iframe, pframe; + + if (!thp) + return AV_NOPTS_VALUE; + + iframe = gp >> thp->gpshift; + pframe = gp & thp->gpmask; if (thp->version < 0x030201) iframe++; |