mirror of
https://github.com/FFmpeg/FFmpeg.git
synced 2026-11-06 05:17:42 +00:00
avformat/oggenc: Reset the current page when it cannot be buffered
On allocation failure the full page stayed in the stream context, and
the next segment was added past its 255 entry segment table.
Fixes: out of array access
Fixes: flOsaBhTFc6F
Fixes: AISLE-2026-0111-00072
Negative size memset Replicated through API with ASAN and av_max_alloc() lowered after the header
Found-by: Joshua Rogers <joshua.rogers@aisle.com>
(cherry picked from commit 6d40aa1739)
This commit is contained in:
1 parent
7adfbe40dc
commit
d1f97282db
1 file changed
+3
-1
@@ -192,8 +192,10 @@ static int ogg_buffer_page(AVFormatContext *s, OGGStreamContext *oggstream)
|
||||
OGGPageList **p = &ogg->page_list;
|
||||
OGGPageList *l = av_mallocz(sizeof(*l));
|
||||
|
||||
if (!l)
|
||||
if (!l) {
|
||||
ogg_reset_cur_page(oggstream);
|
||||
return AVERROR(ENOMEM);
|
||||
}
|
||||
l->page = oggstream->page;
|
||||
|
||||
oggstream->page.start_granule = ogg_granule_to_timestamp(oggstream, oggstream->page.granule);
|
||||
|
||||
Reference in new issue
Block a user