diff options
| author | Ronald S. Bultje <rbultje@ronald.bitfreak.net> | 2004-03-07 04:03:27 +0000 |
|---|---|---|
| committer | Ronald S. Bultje <rbultje@ronald.bitfreak.net> | 2004-03-07 04:03:27 +0000 |
| commit | 2f215bf9d456bbad04178a89e2f25062534264ba (patch) | |
| tree | d1b53cfb4a0f1cd399e8da5d76acb64e42da319b | |
| parent | 63f2860f83131784499118a0cc3fd7ba4d9dcc44 (diff) | |
| download | gst-plugins-bad-2f215bf9d456bbad04178a89e2f25062534264ba.tar.gz gst-plugins-bad-2f215bf9d456bbad04178a89e2f25062534264ba.tar.bz2 gst-plugins-bad-2f215bf9d456bbad04178a89e2f25062534264ba.zip | |
gst/qtdemux/qtdemux.c: Fix crash (j might be greater than n_samples, in which case we're writing outside the allocate...
Original commit message from CVS:
* gst/qtdemux/qtdemux.c: (gst_qtdemux_add_stream),
(qtdemux_parse_trak):
Fix crash (j might be greater than n_samples, in which case we're
writing outside the allocated space for the array) and memleak.
| -rw-r--r-- | ChangeLog | 7 | ||||
| -rw-r--r-- | gst/qtdemux/qtdemux.c | 12 |
2 files changed, 14 insertions, 5 deletions
@@ -1,5 +1,12 @@ 2004-03-06 Ronald Bultje <rbultje@ronald.bitfreak.net> + * gst/qtdemux/qtdemux.c: (gst_qtdemux_add_stream), + (qtdemux_parse_trak): + Fix crash (j might be greater than n_samples, in which case we're + writing outside the allocated space for the array) and memleak. + +2004-03-06 Ronald Bultje <rbultje@ronald.bitfreak.net> + * sys/oss/gstosssink.c: (gst_osssink_chain): And another caller that couldn't handle delay < 0 (unsigned integer overflow). Video now continues playing on an audio diff --git a/gst/qtdemux/qtdemux.c b/gst/qtdemux/qtdemux.c index 5ce3807b..38267655 100644 --- a/gst/qtdemux/qtdemux.c +++ b/gst/qtdemux/qtdemux.c @@ -687,9 +687,10 @@ static void gst_qtdemux_loop_header (GstElement *element) void gst_qtdemux_add_stream(GstQTDemux *qtdemux, QtDemuxStream *stream) { if(stream->subtype == GST_MAKE_FOURCC('v','i','d','e')){ + gchar *name = g_strdup_printf ("video_%02d", qtdemux->n_video_streams); stream->pad = gst_pad_new_from_template ( - gst_static_pad_template_get(&gst_qtdemux_videosrc_template), - g_strdup_printf ("video_%02d", qtdemux->n_video_streams)); + gst_static_pad_template_get(&gst_qtdemux_videosrc_template), name); + g_free (name); stream->fps = 1. * GST_SECOND / stream->samples[0].duration; if(stream->caps){ gst_caps_set_simple(stream->caps, @@ -699,9 +700,10 @@ void gst_qtdemux_add_stream(GstQTDemux *qtdemux, QtDemuxStream *stream) } qtdemux->n_video_streams++; }else{ + gchar *name = g_strdup_printf ("audio_%02d", qtdemux->n_audio_streams); stream->pad = gst_pad_new_from_template ( - gst_static_pad_template_get(&gst_qtdemux_audiosrc_template), - g_strdup_printf ("audio_%02d", qtdemux->n_audio_streams)); + gst_static_pad_template_get(&gst_qtdemux_audiosrc_template), name); + g_free (name); if(stream->caps){ gst_caps_set_simple(stream->caps, "rate", G_TYPE_INT, (int)stream->rate, @@ -1600,6 +1602,7 @@ done: for(j=first_chunk;j<last_chunk;j++){ int chunk_offset; + if(j>=n_samples)goto done2; if(stco){ chunk_offset = QTDEMUX_GUINT32_GET(stco->data + 16 + j*4); }else{ @@ -1620,7 +1623,6 @@ done: #endif samples[j].sample_index = sample_index; sample_index += samples_per_chunk; - if(j>=n_samples)goto done2; } } /* |