Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(45)

Unified Diff: chromium/patches/to_upstream/11b_mkv_buffer_overflow.patch

Issue 9290059: Initial commit of all previous Chrome build scripts. (Closed) Base URL: http://git.chromium.org/chromium/third_party/ffmpeg.git@master
Patch Set: Drop deprecated subfolder. Created 8 years, 11 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: chromium/patches/to_upstream/11b_mkv_buffer_overflow.patch
diff --git a/chromium/patches/to_upstream/11b_mkv_buffer_overflow.patch b/chromium/patches/to_upstream/11b_mkv_buffer_overflow.patch
new file mode 100644
index 0000000000000000000000000000000000000000..4d9dcc5dbff87f925b446d8c0d06191bb5b1613e
--- /dev/null
+++ b/chromium/patches/to_upstream/11b_mkv_buffer_overflow.patch
@@ -0,0 +1,24 @@
+diff -wurp -N orig/libavformat/matroskadec.c ffmpeg/libavformat/matroskadec.c
+--- orig/libavformat/matroskadec.c 2011-07-12 20:48:14.532933135 -0700
++++ ffmpeg/libavformat/matroskadec.c 2011-07-12 20:48:14.583029843 -0700
+@@ -672,9 +676,10 @@ static int ebml_read_float(AVIOContext *
+ static int ebml_read_ascii(AVIOContext *pb, int size, char **str)
+ {
+ av_free(*str);
++ *str = NULL;
+ /* EBML strings are usually not 0-terminated, so we allocate one
+ * byte more, read the string and NULL-terminate it ourselves. */
+- if (!(*str = av_malloc(size + 1)))
++ if (size < 0 || !(*str = av_malloc(size + 1)))
+ return AVERROR(ENOMEM);
+ if (avio_read(pb, (uint8_t *) *str, size) != size) {
+ av_freep(str);
+@@ -931,6 +938,8 @@ static int matroska_probe(AVProbeData *p
+ * Not fully fool-proof, but good enough. */
+ for (i = 0; i < FF_ARRAY_ELEMS(matroska_doctypes); i++) {
+ int probelen = strlen(matroska_doctypes[i]);
++ if (total < probelen)
++ return 0;
+ for (n = 4+size; n <= 4+size+total-probelen; n++)
+ if (!memcmp(p->buf+n, matroska_doctypes[i], probelen))
+ return AVPROBE_SCORE_MAX;

Powered by Google App Engine
This is Rietveld 408576698