# HG changeset patch
# User aurel
# Date 1212448061 0
# Node ID 703f452f00f13bc7868554825ebaaf0622c3c41e
# Parent  b7f86452706e73710c55da841c7c267672fb2c3e
reorganize matroska_add_stream() to fix potential mem leak and buffer overflow
fix CID44

diff -r b7f86452706e -r 703f452f00f1 matroskadec.c
--- a/matroskadec.c	Mon Jun 02 23:01:14 2008 +0000
+++ b/matroskadec.c	Mon Jun 02 23:07:41 2008 +0000
@@ -1021,17 +1021,16 @@
     uint32_t id;
     MatroskaTrack *track;
 
+    /* start with the master */
+    if ((res = ebml_read_master(matroska, &id)) < 0)
+        return res;
+
     av_log(matroska->ctx, AV_LOG_DEBUG, "parsing track, adding stream..,\n");
 
     /* Allocate a generic track. As soon as we know its type we'll realloc. */
     track = av_mallocz(MAX_TRACK_SIZE);
-    matroska->num_tracks++;
     strcpy(track->language, "eng");
 
-    /* start with the master */
-    if ((res = ebml_read_master(matroska, &id)) < 0)
-        return res;
-
     /* try reading the trackentry headers */
     while (res == 0) {
         if (!(id = ebml_peek_id(matroska, &matroska->level_up))) {
@@ -1088,7 +1087,6 @@
                         track->type = MATROSKA_TRACK_TYPE_NONE;
                         break;
                 }
-                matroska->tracks[matroska->num_tracks - 1] = track;
                 break;
             }
 
@@ -1623,6 +1621,11 @@
         }
     }
 
+    if (track->type && matroska->num_tracks < ARRAY_SIZE(matroska->tracks)) {
+        matroska->tracks[matroska->num_tracks++] = track;
+    } else {
+        av_free(track);
+    }
     return res;
 }