[vlc-commits] demux: avi: fix invalid dereference

[Francois Cartegnie]

vlc/vlc-3.0 | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Thu Oct 22 15:30:10 2020 +0200| [a7f577ec26d35bbd7b2a3cda89d1b41bde69de9c] | committer: Hugo Beauzée-Luyssen

demux: avi: fix invalid dereference

the stored track index might not match the one
at parsing time

Reported by: Zhen Zhou, NSFOCUS Security Team

Signed-off-by: Hugo Beauzée-Luyssen <hugo at beauzee.fr>
(cherry picked from commit 41541125de479fdff0ed0dcd73a6bbc64e598727)
Signed-off-by: Hugo Beauzée-Luyssen <hugo at beauzee.fr>

> http://git.videolan.org/gitweb.cgi/vlc/vlc-3.0.git/?a=commit;h=a7f577ec26d35bbd7b2a3cda89d1b41bde69de9c
---

 modules/demux/avi/avi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/demux/avi/avi.c b/modules/demux/avi/avi.c
index fbd08b6422..9ca8043472 100644
--- a/modules/demux/avi/avi.c
+++ b/modules/demux/avi/avi.c
@@ -916,7 +916,7 @@ aviindex:
             tk->i_samplesize != 0 )
             continue;
 
-        avi_chunk_list_t *p_strl = AVI_ChunkFind( p_hdrl, AVIFOURCC_strl, i, true );
+        avi_chunk_list_t *p_strl = AVI_ChunkFind( p_hdrl, AVIFOURCC_strl, tk->fmt.i_id, true );
         avi_chunk_strf_t *p_strf = AVI_ChunkFind( p_strl, AVIFOURCC_strf, 0, false );
         if( !p_strf || p_strf->i_cat != AUDIO_ES )
             continue;