Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(43)

Side by Side Diff: chromium/patches/to_upstream/11b_mkv_buffer_overflow.patch

Issue 9290059: Initial commit of all previous Chrome build scripts. (Closed) Base URL: http://git.chromium.org/chromium/third_party/ffmpeg.git@master
Patch Set: Drop deprecated subfolder. Created 8 years, 11 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
(Empty)
1 diff -wurp -N orig/libavformat/matroskadec.c ffmpeg/libavformat/matroskadec.c
2 --- orig/libavformat/matroskadec.c 2011-07-12 20:48:14.532933135 -0700
3 +++ ffmpeg/libavformat/matroskadec.c 2011-07-12 20:48:14.583029843 -0700
4 @@ -672,9 +676,10 @@ static int ebml_read_float(AVIOContext *
5 static int ebml_read_ascii(AVIOContext *pb, int size, char **str)
6 {
7 av_free(*str);
8 + *str = NULL;
9 /* EBML strings are usually not 0-terminated, so we allocate one
10 * byte more, read the string and NULL-terminate it ourselves. */
11 - if (!(*str = av_malloc(size + 1)))
12 + if (size < 0 || !(*str = av_malloc(size + 1)))
13 return AVERROR(ENOMEM);
14 if (avio_read(pb, (uint8_t *) *str, size) != size) {
15 av_freep(str);
16 @@ -931,6 +938,8 @@ static int matroska_probe(AVProbeData *p
17 * Not fully fool-proof, but good enough. */
18 for (i = 0; i < FF_ARRAY_ELEMS(matroska_doctypes); i++) {
19 int probelen = strlen(matroska_doctypes[i]);
20 + if (total < probelen)
21 + return 0;
22 for (n = 4+size; n <= 4+size+total-probelen; n++)
23 if (!memcmp(p->buf+n, matroska_doctypes[i], probelen))
24 return AVPROBE_SCORE_MAX;
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698