yshaw1...@163.com:
> From: Yang Xiao <ysha...@outlook.com>
>
> Pointer member side_data of AVPacket that allocated by stack may be wild
> pointer.
> Prevent releasing wild pointers in AVPacket when some functions try to call
> av_packet_unref()
> ---
> libavformat/asfdec_f.c | 10 ++++++++--
> 1 file changed, 8 insertions(+), 2 deletions(-)
>
> diff --git a/libavformat/asfdec_f.c b/libavformat/asfdec_f.c
> index a8f36ed286..605d9f53a1 100644
> --- a/libavformat/asfdec_f.c
> +++ b/libavformat/asfdec_f.c
> @@ -1433,7 +1433,9 @@ static int64_t asf_read_pts(AVFormatContext *s, int
> stream_index,
> {
> FFFormatContext *const si = ffformatcontext(s);
> ASFContext *asf = s->priv_data;
> - AVPacket pkt1, *pkt = &pkt1;
> + AVPacket *pkt = av_packet_alloc();
> + if(!pkt)
> + return AVERROR(ENOMEM);
> ASFStream *asf_st;
> int64_t pts;
> int64_t pos = *ppos;
> @@ -1448,13 +1450,16 @@ static int64_t asf_read_pts(AVFormatContext *s, int
> stream_index,
> s->packet_size * s->packet_size +
> si->data_offset;
> *ppos = pos;
> - if (avio_seek(s->pb, pos, SEEK_SET) < 0)
> + if (avio_seek(s->pb, pos, SEEK_SET) < 0) {
> + av_packet_free(&pkt);
> return AV_NOPTS_VALUE;
> + }
>
> ff_read_frame_flush(s);
> asf_reset_header(s);
> for (;;) {
> if (av_read_frame(s, pkt) < 0) {
> + av_packet_free(&pkt);
> av_log(s, AV_LOG_INFO, "asf_read_pts failed\n");
> return AV_NOPTS_VALUE;
> }
> @@ -1483,6 +1488,7 @@ static int64_t asf_read_pts(AVFormatContext *s, int
> stream_index,
> }
>
> *ppos = pos;
> + av_packet_free(&pkt);
> return pts;
> }
>
>
To repeat myself: Do you have FF_API_INIT_PACKET set to 0 (it should
still be set to 1)? Because av_read_frame() is supposed to (and
documented to) treat the packet it is given as uninitialized.
- Andreas
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
