This fixes segmentation faults caused by passing a packet_ptr of NULL to
memcpy.
Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com>
---
libavformat/ffmdec.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/libavformat/ffmdec.c b/libavformat/ffmdec.c
index 9fe4155..7b2d0d7 100644
--- a/libavformat/ffmdec.c
+++ b/libavformat/ffmdec.c
@@ -123,8 +123,10 @@ static int ffm_read_data(AVFormatContext *s,
frame_offset = avio_rb16(pb);
avio_read(pb, ffm->packet, ffm->packet_size - FFM_HEADER_SIZE);
ffm->packet_end = ffm->packet + (ffm->packet_size -
FFM_HEADER_SIZE - fill_size);
- if (ffm->packet_end < ffm->packet || frame_offset < 0)
+ if (ffm->packet_end < ffm->packet || frame_offset < 0) {
+ ffm->packet_end = ffm->packet_ptr;
return -1;
+ }
/* if first packet or resynchronization packet, we must
handle it specifically */
if (ffm->first_packet || (frame_offset & 0x8000)) {
@@ -140,8 +142,10 @@ static int ffm_read_data(AVFormatContext *s,
return 0;
}
ffm->first_packet = 0;
- if ((frame_offset & 0x7fff) < FFM_HEADER_SIZE)
+ if ((frame_offset & 0x7fff) < FFM_HEADER_SIZE) {
+ ffm->packet_end = ffm->packet_ptr;
return -1;
+ }
ffm->packet_ptr = ffm->packet + (frame_offset & 0x7fff) -
FFM_HEADER_SIZE;
if (!header)
break;
--
2.6.4
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
