• Andreas Rheinhardt's avatar
    avformat/matroskadec: Fix use-after-free when demuxing ProRes · af50f0a5
    Andreas Rheinhardt authored
    ProRes in Matroska is supposed to not contain the first atom header
    (containing a size field and the tag "icpf") and therefore the Matroska
    demuxer has to recreate it; this involves an allocation and copy, of
    course. Whether the old buffer (containing the data without the atom
    header) needs to be freed or not depends upon whether it is what was
    directly read (in which case it is owned by an AVBuffer) or whether it
    has been allocated when reversing the track's content compression (e.g.
    zlib compression) that Matroska supports.
    
    So there are three pointers involved: The one pointing to the directly
    read data (owned by the AVBuffer), the one pointing to the currently
    valid data (which coincides with the former if no content compression
    needed to be reverted) and the one pointing to the new data with the
    first atom header. The check for whether to free the second of these is
    simply whether the first two are different.
    
    This works mostly, but there is a complication: Some muxers don't strip
    the first atom header away and in this case, it is also not reinserted
    and no new buffer is allocated; instead, the second and the third
    pointers agree. In this case, one must never free the second buffer.
    Yet it is currently done if the track is e.g. zlib compressed.
    This commit fixes this.
    
    This is a regression since b8e75a2a.
    Signed-off-by: 's avatarAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
    Signed-off-by: 's avatarJames Almer <jamrial@gmail.com>
    af50f0a5
Name
Last commit
Last update
compat Loading commit data...
doc Loading commit data...
ffbuild Loading commit data...
fftools Loading commit data...
libavcodec Loading commit data...
libavdevice Loading commit data...
libavfilter Loading commit data...
libavformat Loading commit data...
libavresample Loading commit data...
libavutil Loading commit data...
libpostproc Loading commit data...
libswresample Loading commit data...
libswscale Loading commit data...
presets Loading commit data...
tests Loading commit data...
tools Loading commit data...
.gitattributes Loading commit data...
.gitignore Loading commit data...
.travis.yml Loading commit data...
CONTRIBUTING.md Loading commit data...
COPYING.GPLv2 Loading commit data...
COPYING.GPLv3 Loading commit data...
COPYING.LGPLv2.1 Loading commit data...
COPYING.LGPLv3 Loading commit data...
CREDITS Loading commit data...
Changelog Loading commit data...
INSTALL.md Loading commit data...
LICENSE.md Loading commit data...
MAINTAINERS Loading commit data...
Makefile Loading commit data...
README.md Loading commit data...
RELEASE Loading commit data...
configure Loading commit data...