From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id 4A97342A25 for ; Tue, 11 Jan 2022 06:39:09 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id A29CD68AEB1; Tue, 11 Jan 2022 08:39:07 +0200 (EET) Received: from m12-14.163.com (m12-14.163.com [220.181.12.14]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id EF20568A6F6 for ; Tue, 11 Jan 2022 08:38:59 +0200 (EET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com; s=s110527; h=From:Subject:Date:Message-Id:MIME-Version; bh=gJeJS dNq2FjHfQtGXGjluMkL7dr8qEjBi45ZzMvUKF4=; b=DdmbaPgaMwG1JjkpFMMBu 1i1hnIp4oQTaypvEHyul+zyoYMAx1l66VBrCB9KftcN8ilqO38azBaVZH8LyLHwR K6Zg8tLMNHb/U5aY1sdMjOGpc1Le7Ixu6AH5ZKHFA3u9VEr+CK5LSGNgmLq2eUCl momqz9Ed1UOepdzH/PTmj0= Received: from localhost.localdomain (unknown [103.107.216.227]) by smtp10 (Coremail) with SMTP id DsCowAB3S8oBJt1hXURWHQ--.12415S2; Tue, 11 Jan 2022 14:38:58 +0800 (CST) From: Yang Xiao To: ffmpeg-devel@ffmpeg.org Date: Tue, 11 Jan 2022 14:38:56 +0800 Message-Id: <20220111063856.15699-1-yshaw1999@163.com> X-Mailer: git-send-email 2.30.1 (Apple Git-130) MIME-Version: 1.0 X-CM-TRANSID: DsCowAB3S8oBJt1hXURWHQ--.12415S2 X-Coremail-Antispam: 1Uf129KBjvJXoW7AF18GryUtF1UurWkXF48Xrb_yoW8XFyfp3 9FvF1Ikr1rXayYvrnrtayvqr1xJr1kK34S9w48Z3Wa93s5urn8Xr90gFWFkr1DWry8XFy8 Zrn5Z3WUWr1DWFJanT9S1TB71UUUUbUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x07jrmRUUUUUU= X-Originating-IP: [103.107.216.227] X-CM-SenderInfo: 51vkt4irzzmqqrwthudrp/xtbBlxSF7FSIl-aymwABs- Subject: [FFmpeg-devel] [PATCH] avformat/asfdec: fix crash caused by free wlid pointers X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Yang Xiao , yshaw1999@163.com Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: From: Yang Xiao This commit fixed a crash when seeking wma frames, asf decoder will try to demux in function asf_read_pts(). Pointer member side_data of AVPacket that allocated by stack may be wild pointer. Prevent releasing wild pointers in AVPacket when some functions try to call av_packet_unref, example av_read_frame(). --- libavformat/asfdec_f.c | 2 +- libavformat/mpc.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/libavformat/asfdec_f.c b/libavformat/asfdec_f.c index a8f36ed286..bae0ecfc7c 100644 --- a/libavformat/asfdec_f.c +++ b/libavformat/asfdec_f.c @@ -1433,7 +1433,7 @@ static int64_t asf_read_pts(AVFormatContext *s, int stream_index, { FFFormatContext *const si = ffformatcontext(s); ASFContext *asf = s->priv_data; - AVPacket pkt1, *pkt = &pkt1; + AVPacket pkt1 = {0}, *pkt = &pkt1; ASFStream *asf_st; int64_t pts; int64_t pos = *ppos; diff --git a/libavformat/mpc.c b/libavformat/mpc.c index b5b2bab33c..ad0d693152 100644 --- a/libavformat/mpc.c +++ b/libavformat/mpc.c @@ -189,7 +189,7 @@ static int mpc_read_seek(AVFormatContext *s, int stream_index, int64_t timestamp AVStream *st = s->streams[stream_index]; FFStream *const sti = ffstream(st); MPCContext *c = s->priv_data; - AVPacket pkt1, *pkt = &pkt1; + AVPacket pkt1 = {0}, *pkt = &pkt1; int ret; int index = av_index_search_timestamp(st, FFMAX(timestamp - DELAY_FRAMES, 0), flags); uint32_t lastframe; -- 2.30.1 (Apple Git-130) _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".