Recherche avancée

Sur d’autres sites (12832)

• avformat/matroskadec : Fix use-after-free when demuxing ProRes

  7 décembre 2019, par Andreas Rheinhardt

  avformat/matroskadec : Fix use-after-free when demuxing ProRes
  ProRes in Matroska is supposed to not contain the first atom header
  
  (containing a size field and the tag "icpf") and therefore the Matroska
  
  demuxer has to recreate it ; this involves an allocation and copy, of
  
  course. Whether the old buffer (containing the data without the atom
  
  header) needs to be freed or not depends upon whether it is what was
  
  directly read (in which case it is owned by an AVBuffer) or whether it
  
  has been allocated when reversing the track's content compression (e.g.
  
  zlib compression) that Matroska supports.
  So there are three pointers involved : The one pointing to the directly
  
  read data (owned by the AVBuffer), the one pointing to the currently
  
  valid data (which coincides with the former if no content compression
  
  needed to be reverted) and the one pointing to the new data with the
  
  first atom header. The check for whether to free the second of these is
  
  simply whether the first two are different.
  This works mostly, but there is a complication : Some muxers don't strip
  
  the first atom header away and in this case, it is also not reinserted
  
  and no new buffer is allocated ; instead, the second and the third
  
  pointers agree. In this case, one must never free the second buffer.
  
  Yet it is currently done if the track is e.g. zlib compressed.
  
  This commit fixes this.
  This is a regression since b8e75a2a.
  Signed-off-by : Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
  
  Signed-off-by : James Almer <jamrial@gmail.com>
  

  • [DH] libavformat/matroskadec.c

• avformat/id3v2 : Fix double-free on error

  10 novembre 2019, par Andreas Rheinhardt

  avformat/id3v2 : Fix double-free on error
  ff_id3v2_parse_priv_dict() uses av_dict_set() with the flags
  
  AV_DICT_DONT_STRDUP_KEY and AV_DICT_DONT_STRDUP_VAL. In this case both
  
  key and value are freed on error (and owned by the destination
  
  dictionary on success), so that freeing them again on error is a
  
  double-free and therefore forbidden. But it nevertheless happened.
  Fixes CID 1452489 and 1452421.
  Signed-off-by : Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
  
  Signed-off-by : Michael Niedermayer <michael@niedermayer.cc>
  

  • [DH] libavformat/id3v2.c

• avformat/icecast : Free the right buffer on error

  10 novembre 2019, par Andreas Rheinhardt

  avformat/icecast : Free the right buffer on error
  In case an AVBPrint was not complete, icecast_open() would free some
  
  buffers that have not been allocated yet instead of freeing the data of
  
  the AVBPrint (if they have been allocated). Because this error does not
  
  trigger a jump to the general cleanup section any more, one can moreover
  
  remove a (now unnecessary) initialization of a pointer.
  Furthermore, finalizing an AVBPrint can fail (namely when the string
  
  inside the AVBPrint has not been allocated yet) and so this needs to be
  
  checked.
  Signed-off-by : Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
  
  Signed-off-by : Michael Niedermayer <michael@niedermayer.cc>
  

  • [DH] libavformat/icecast.c