From patchwork Wed Apr 29 15:14:14 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Lance Wang X-Patchwork-Id: 19374 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id 35CBF44AEFB for ; Wed, 29 Apr 2020 18:14:35 +0300 (EEST) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 20E3268C073; Wed, 29 Apr 2020 18:14:35 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from mail-pl1-f194.google.com (mail-pl1-f194.google.com [209.85.214.194]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 28C0F68BFDA for ; Wed, 29 Apr 2020 18:14:27 +0300 (EEST) Received: by mail-pl1-f194.google.com with SMTP id t16so937403plo.7 for ; Wed, 29 Apr 2020 08:14:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=hYpNYoaanaaFOhbhHZ/on4Vz3amNnLR6hCRWPG2o/IU=; b=WwHuMk/tYG/MHQBE2elwWdFVfy+79/Jm5YGcPECAmsZkyGEygf3c7sIwXdUol5p/5S 5o1PhquU6cQEBeHpVAdg69Ruipf6/JEa/1PyQrfPJUSDgwXK2fFVZc+FCS1h4gqeGcii FEBhkA3hxuPd6I4AKTUcvY+5Vd7FnnkMNkZYlFUYCQnal75huV2GtVMCKfJzlrS2P9ZF eET9lCOVXysLcZlVzrwpDeBUepgWxXaPHoHfRCYWeYjA1tr/eDlb/xGA8imvtX24ZltK yvEcOCFMid05iLDwIDjkPYoJRR5gDy4L9gyjNEwNJKwLaCQPPs/IYuwdsSUeC90VhCXe y9Jg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=hYpNYoaanaaFOhbhHZ/on4Vz3amNnLR6hCRWPG2o/IU=; b=kq4f2COcL6GHZ+7qIHJxcLzsb/ncN7MPNit2DqLktJVzZvgmks5ZlBVQE7AuLMhQR0 mMBceg87HSHUMrSxRCSJ+kjVtITF6xcA9VmDPhyDxAsS05DcMQv3xYOsfmol+/UV1UqD NnSiixNwYdbybCZzVGp+V4QgTgkpdKiqzEkwfJ2Gij+fa4vZs17RhLpY2ShlynAZaiXU SRACvNH+qb5X0QSW0stk4g7AbZ7P8VgHKGFg/BUgEfTvsNx3RZWe0ENOK4A5z4FZG+gA Y2XnI680pTmY9DnsbRXO8rpOV5bv7jRoV6harnO0/zXVNNvAyEWwi7efXIv4Tgmo7BDe MfTQ== X-Gm-Message-State: AGi0PuZrJnxphiAFmkWvwpOIIUhuE2C4LKRTO9FzbD6Z9cnxQZX3E2/4 ZqH5+PJYyjBLiPRmzytAqqah0DW8 X-Google-Smtp-Source: APiQypKqb9PomEWUqOnFcIase+OVX8XVGnyJvHYC3t98xKmtEZHqM0CJeXhEOVKQyNuySuh8mwVDog== X-Received: by 2002:a17:902:fe87:: with SMTP id x7mr34482692plm.282.1588173264845; Wed, 29 Apr 2020 08:14:24 -0700 (PDT) Received: from vpn2.localdomain ([161.117.202.209]) by smtp.gmail.com with ESMTPSA id t12sm1243688pgm.37.2020.04.29.08.14.23 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 29 Apr 2020 08:14:24 -0700 (PDT) From: lance.lmwang@gmail.com To: ffmpeg-devel@ffmpeg.org Date: Wed, 29 Apr 2020 23:14:14 +0800 Message-Id: <1588173257-14531-2-git-send-email-lance.lmwang@gmail.com> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1588173257-14531-1-git-send-email-lance.lmwang@gmail.com> References: <1588173257-14531-1-git-send-email-lance.lmwang@gmail.com> Subject: [FFmpeg-devel] [PATCH 2/5] avformat/matroskaenc: fix invalid pointer access if avio_get_dyn_buf failed X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Limin Wang MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" From: Limin Wang Signed-off-by: Limin Wang --- libavformat/matroskaenc.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavformat/matroskaenc.c b/libavformat/matroskaenc.c index 784973a951..f0474da44f 100644 --- a/libavformat/matroskaenc.c +++ b/libavformat/matroskaenc.c @@ -374,9 +374,12 @@ static void end_ebml_master_crc32(AVIOContext *pb, AVIOContext **dyn_cp, put_ebml_length(pb, size, length_size); if (mkv->write_crc) { skip = 6; /* Skip reserved 6-byte long void element from the dynamic buffer. */ + if (size > skip) { AV_WL32(crc, av_crc(av_crc_get_table(AV_CRC_32_IEEE_LE), UINT32_MAX, buf + skip, size - skip) ^ UINT32_MAX); put_ebml_binary(pb, EBML_ID_CRC32, crc, sizeof(crc)); + } } + if (size > skip) avio_write(pb, buf + skip, size - skip); if (keep_buffer) {