From 951cbea56fdc03ef96d07fbd7e5bed755d42ac8a Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 22 Apr 2012 20:03:53 +0200 Subject: [PATCH] mpeg12dec: reset data size after parsing extradata. This ended up corrupting data structures and may possibly lead to a double free. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer --- libavcodec/mpeg12.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavcodec/mpeg12.c b/libavcodec/mpeg12.c index ea19b819cc1..b66d535e281 100644 --- a/libavcodec/mpeg12.c +++ b/libavcodec/mpeg12.c @@ -2289,6 +2289,7 @@ static int mpeg_decode_frame(AVCodecContext *avctx, if (avctx->extradata && !avctx->frame_number) { int ret = decode_chunks(avctx, picture, data_size, avctx->extradata, avctx->extradata_size); + *data_size = 0; if (ret < 0 && (avctx->err_recognition & AV_EF_EXPLODE)) return ret; } -- 2.39.2