Fix overflow in STSD parser
Reset `sc->stsd_count` before parsing entries. This number doesn't get reset, which means that multiple parse passes can increment it past the `sc->extradata` array end and cause OOB writes.
This commit is contained in:
@@ -3258,6 +3258,7 @@ fail:
|
||||
av_freep(&sc->extradata[j]);
|
||||
}
|
||||
|
||||
sc->stsd_count = 0;
|
||||
av_freep(&sc->extradata);
|
||||
av_freep(&sc->extradata_size);
|
||||
return ret;
|
||||
|
||||
Reference in New Issue
Block a user