demux(avi): fix crash occuring when trying to open some avi files

fmt.p_extra should only reference malloc'ed memory, since it is cleaned
with free() in es_format_Clean.

This patch reuses the same logic for p_vids as that of p_auds.

diff --git a/modules/demux/avi/avi.c b/modules/demux/avi/avi.c
index fc1d24e8e2fb630300eeef76bd4fb4f7375e9b61..523537624fc0e0dd94ce2583d87ee40adb2b0b0c 100644 (file)
--- a/modules/demux/avi/avi.c
+++ b/modules/demux/avi/avi.c
@@ -569,7 +569,10 @@ static int Open( vlc_object_t * p_this )
                 fmt.i_extra =
                     __MIN( p_vids->p_bih->biSize - sizeof( BITMAPINFOHEADER ),
                            p_vids->i_chunk_size - sizeof(BITMAPINFOHEADER) );
-                fmt.p_extra = &p_vids->p_bih[1];
+                fmt.p_extra = malloc( fmt.i_extra );
+                if( !fmt.p_extra ) goto error;
+                memcpy( fmt.p_extra, &p_vids->p_bih[1], fmt.i_extra );
+
                 msg_Dbg( p_demux, "stream[%d] video(%4.4s) %"PRIu32"x%"PRIu32" %dbpp %ffps",
                          i, (char*)&p_vids->p_bih->biCompression,
                          (uint32_t)p_vids->p_bih->biWidth,