| commit | ba4699385f30536c6531273c5fb1812025cda615 | |
| author | Filip Roséen <filip@atch.se> | |
| Thu, 2 Mar 2017 16:40:23 +0000 (2 17:40 +0100) | ||
| committer | Jean-Baptiste Kempf <jb@videolan.org> | |
| Fri, 3 Mar 2017 15:01:08 +0000 (3 16:01 +0100) | ||
| tree | 3dfb975883d27e757f4d544a865ed0de8bfc2747 | treesnapshot (tar.gz zip) |
| parent | 9f4b1a474d4ae229b11d2ef3044a8609ef000f25 | commitdiff |
demux/subtitle: TextLoad + TextUnload: prevent double-free
There is a relationshop between the value of txt->i_line_count and
txt->line stating that the value of txt->line is undefined if
txt->i_line_count is zero.
As the above might seem simple enough, it leads to a case double-free
if one does not pay attention and check the value of txt->i_line_count
prior to working with txt->line; as in TextUnload.
These changes make sure that we do not read from txt->line unless we
know that it is safe.
Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>
There is a relationshop between the value of txt->i_line_count and
txt->line stating that the value of txt->line is undefined if
txt->i_line_count is zero.
As the above might seem simple enough, it leads to a case double-free
if one does not pay attention and check the value of txt->i_line_count
prior to working with txt->line; as in TextUnload.
These changes make sure that we do not read from txt->line unless we
know that it is safe.
Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>
| modules/demux/subtitle.c | diffblobblamehistory |