[vlc-commits] commit: demux(avi): fix crash occuring when trying to open some avi files ( Erwan Tulou )

[git at videolan.org]

vlc/vlc-1.0 | branch: master | Erwan Tulou <erwan10 at videolan.org> | Tue Feb 16 13:07:10 2010 +0100| [48e361aa510e29a4321d6427491fed5297ce88e9] | committer: Rémi Denis-Courmont 

demux(avi): fix crash occuring when trying to open some avi files

fmt.p_extra should only reference malloc'ed memory, since it is cleaned
with free() in es_format_Clean.

This patch reuses the same logic for p_vids as that of p_auds.
(cherry picked from commit 97b484a832fa5846a69c538047c7761e749e939d)

Signed-off-by: Rémi Denis-Courmont <remi at remlab.net>

> http://git.videolan.org/gitweb.cgi/vlc/vlc-1.0.git/?a=commit;h=48e361aa510e29a4321d6427491fed5297ce88e9
---

 modules/demux/avi/avi.c |    5 ++++-
 1 files changed, 4 insertions(+), 1 deletions(-)

diff --git a/modules/demux/avi/avi.c b/modules/demux/avi/avi.c
index 47a97e4..96add94 100644
--- a/modules/demux/avi/avi.c
+++ b/modules/demux/avi/avi.c
@@ -567,7 +567,10 @@ static int Open( vlc_object_t * p_this )
                 fmt.i_extra =
                     __MIN( p_vids->p_bih->biSize - sizeof( BITMAPINFOHEADER ),
                            p_vids->i_chunk_size - sizeof(BITMAPINFOHEADER) );
-                fmt.p_extra = &p_vids->p_bih[1];
+                fmt.p_extra = malloc( fmt.i_extra );
+                if( !fmt.p_extra ) goto error;
+                memcpy( fmt.p_extra, &p_vids->p_bih[1], fmt.i_extra );
+
                 msg_Dbg( p_demux, "stream[%d] video(%4.4s) %"PRIu32"x%"PRIu32" %dbpp %ffps",
                          i, (char*)&p_vids->p_bih->biCompression,
                          (uint32_t)p_vids->p_bih->biWidth,