# HG changeset patch # User reimar # Date 1292164277 0 # Node ID 231764e0b7555d224cca7afd93757885b8da5769 # Parent 34c4e6ff7b17c16832a08273adc520d67d70e340 Avoid using uninitialized data if index read does not return enough data. diff -r 34c4e6ff7b17 -r 231764e0b755 libmpdemux/aviheader.c --- a/libmpdemux/aviheader.c Sun Dec 12 13:56:35 2010 +0000 +++ b/libmpdemux/aviheader.c Sun Dec 12 14:31:17 2010 +0000 @@ -378,13 +378,15 @@ if(demuxer->movi_end>stream_tell(demuxer->stream)) demuxer->movi_end=stream_tell(demuxer->stream); // fixup movi-end if(index_mode && !priv->isodml){ + int read; int i; priv->idx_size=size2>>4; mp_msg(MSGT_HEADER,MSGL_V,MSGTR_MPDEMUX_AVIHDR_ReadingIndexBlockChunksForFrames, priv->idx_size,avih.dwTotalFrames, (int64_t)stream_tell(demuxer->stream)); priv->idx=malloc(priv->idx_size<<4); // printf("\nindex to %p !!!!! (priv=%p)\n",priv->idx,priv); - stream_read(demuxer->stream,(char*)priv->idx,priv->idx_size<<4); + read = stream_read(demuxer->stream,(char*)priv->idx,priv->idx_size<<4); + priv->idx_size = FFMAX(read, 0) >> 4; for (i = 0; i < priv->idx_size; i++) { // swap index to machine endian AVIINDEXENTRY *entry=(AVIINDEXENTRY*)priv->idx + i; le2me_AVIINDEXENTRY(entry);