avilib bug causes avifix segfault in transcode 1.04
Vadim Druzhin <[email protected]>
| Newsgroups | gmane.comp.video.transcode.devel |
|---|---|
| Organization | VNIINM |
| Message-ID | <[email protected]> |
cmdline: avifix -f 25,1 -i out.avi
causes segfault on large avi file (out.avi is 4197853758 bytes).
gdb report:
Program terminated with signal 11, Segmentation fault.
#0 0x0804d934 in AVI_close (AVI=0x97d7008) at avilib.c:1913
1913 if (AVI->video_superindex->stdindex[j]) {
(gdb) bt
#0 0x0804d934 in AVI_close (AVI=0x97d7008) at avilib.c:1913
#1 0x08049173 in main (argc=2019847785, argv=0x78) at avifix.c:344
Attached patch fixes this for me.
--
WBR,
Vadim Druzhin <[email protected]>
transcode-1.0.4-avilib.patch
(text/plain, 652 B)
diff -urN transcode-1.0.4.orig/avilib/avilib.c transcode-1.0.4/avilib/avilib.c --- transcode-1.0.4.orig/avilib/avilib.c 2005-11-06 08:57:52.000000000 +0300 +++ transcode-1.0.4/avilib/avilib.c 2007-11-08 16:47:01.000000000 +0300 @@ -2483,6 +2483,7 @@ a = hdrl_data+i; AVI->video_superindex = (avisuperindex_chunk *) malloc (sizeof (avisuperindex_chunk)); + memset(AVI->video_superindex, 0, sizeof (avisuperindex_chunk)); memcpy (AVI->video_superindex->fcc, a, 4); a += 4; AVI->video_superindex->dwSize = str2ulong(a); a += 4; AVI->video_superindex->wLongsPerEntry = str2ushort(a); a += 2;