[vlc-commits] Avoid double free in case of corrupted files

[Denis Charmet]

vlc/vlc-2.1 | branch: master | Denis Charmet <typx at dinauz.org> | Sun Oct 13 23:39:56 2013 +0200| [5d571b120a9b823f4317b2a2beb42a525cc4ea8c] | committer: Denis Charmet

Avoid double free in case of corrupted files

> http://git.videolan.org/gitweb.cgi/vlc/vlc-2.1.git/?a=commit;h=5d571b120a9b823f4317b2a2beb42a525cc4ea8c
---

 modules/demux/mkv/Ebml_parser.cpp      |    5 +++++
 modules/demux/mkv/Ebml_parser.hpp      |    1 +
 modules/demux/mkv/matroska_segment.cpp |    8 +++++++-
 3 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/modules/demux/mkv/Ebml_parser.cpp b/modules/demux/mkv/Ebml_parser.cpp
index 6bb1c5b..6890f41 100644
--- a/modules/demux/mkv/Ebml_parser.cpp
+++ b/modules/demux/mkv/Ebml_parser.cpp
@@ -121,6 +121,11 @@ void EbmlParser::Keep( void )
     mb_keep = true;
 }
 
+void EbmlParser::Unkeep()
+{
+    mb_keep = false;
+}
+
 int EbmlParser::GetLevel( void ) const
 {
     return mi_user_level;
diff --git a/modules/demux/mkv/Ebml_parser.hpp b/modules/demux/mkv/Ebml_parser.hpp
index 40abafd..57fdf23 100644
--- a/modules/demux/mkv/Ebml_parser.hpp
+++ b/modules/demux/mkv/Ebml_parser.hpp
@@ -41,6 +41,7 @@ class EbmlParser
     void Reset( demux_t *p_demux );
     EbmlElement *Get( int n_call = 0 );
     void        Keep( void );
+    void        Unkeep( void );
     EbmlElement *UnGet( uint64 i_block_pos, uint64 i_cluster_pos );
 
     int  GetLevel( void ) const;
diff --git a/modules/demux/mkv/matroska_segment.cpp b/modules/demux/mkv/matroska_segment.cpp
index 9f00f42..2244400 100644
--- a/modules/demux/mkv/matroska_segment.cpp
+++ b/modules/demux/mkv/matroska_segment.cpp
@@ -1215,7 +1215,7 @@ int matroska_segment_c::BlockGet( KaxBlock * & pp_block, KaxSimpleBlock * & pp_s
             /* Check blocks validity to protect againts broken files */
             if( BlockFindTrackIndex( &i_tk, pp_block , pp_simpleblock ) )
             {
-                delete pp_block;
+                ep->Unkeep();
                 pp_simpleblock = NULL;
                 pp_block = NULL;
                 continue;
@@ -1361,6 +1361,9 @@ int matroska_segment_c::BlockGet( KaxBlock * & pp_block, KaxSimpleBlock * & pp_s
                     {
                         msg_Err( &sys.demuxer, "Error while reading %s... upping level", typeid(*el).name());
                         ep->Up();
+                        ep->Unkeep();
+                        pp_simpleblock = NULL;
+                        pp_block = NULL;
                         break;
                     }
                     if( MKV_IS_ID( el, KaxBlock ) )
@@ -1414,6 +1417,9 @@ int matroska_segment_c::BlockGet( KaxBlock * & pp_block, KaxSimpleBlock * & pp_s
         {
             msg_Err( &sys.demuxer, "Error while reading %s... upping level", typeid(*el).name());
             ep->Up();
+            ep->Unkeep();
+            pp_simpleblock = NULL;
+            pp_block = NULL;
         }
     }
 }