• Xiaohan Wang's avatar
    matroskadec: Fix read-after-free in matroska_read_seek() · 490a3ebf
    Xiaohan Wang authored
    In matroska_read_seek(), |tracks| is assigned at the begining of the
    function. However, functions like matroska_parse_cues() could reallocate
    the tracks and invalidate |tracks|.
    
    This assigns |tracks| only before using it, so that it will not get
    invalidated elsewhere.
    
    Bug-Id: chromium/427266
    490a3ebf
matroskadec.c 90.2 KB