matroskadec: make sure not to leave EbmlBin in an inconsistent state

Message ID 20170105010618.6D0E75DAC9@aruru.libav.org
State New
Headers show

Commit Message

Janne Grunau Jan. 5, 2017, 1:06 a.m.
Module: libav
Branch: master
Commit: 9026ec8aaf5fa19cb4fb266c16f608af0d863b2b

Author:    Anton Khirnov <anton@khirnov.net>
Committer: Sean McGovern <gseanmcg@gmail.com>
Date:      Wed Dec 28 13:15:14 2016 +0100

matroskadec: make sure not to leave EbmlBin in an inconsistent state

If a read fails, the current code will free the data but leave the size
non-zero. Make sure the size is zeroed in such a case.

CC: libav-stable@libav.org
Bug-Id: 1001
Found-By: Kamil Frankowicz
Signed-off-by: Sean McGovern <gseanmcg@gmail.com>

---

 libavformat/matroskadec.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

Patch

diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c
index a3954b0..4e121b6 100644
--- a/libavformat/matroskadec.c
+++ b/libavformat/matroskadec.c
@@ -750,16 +750,19 @@  static int ebml_read_ascii(AVIOContext *pb, int size, char **str)
 static int ebml_read_binary(AVIOContext *pb, int length, EbmlBin *bin)
 {
     av_free(bin->data);
+    bin->size = 0;
+
     if (!(bin->data = av_mallocz(length + AV_INPUT_BUFFER_PADDING_SIZE)))
         return AVERROR(ENOMEM);
 
-    bin->size = length;
     bin->pos  = avio_tell(pb);
     if (avio_read(pb, bin->data, length) != length) {
         av_freep(&bin->data);
         return AVERROR(EIO);
     }
 
+    bin->size = length;
+
     return 0;
 }