diff options
| author | Max Kellermann <max@duempel.org> | 2016-07-14 10:22:43 +0200 |
|---|---|---|
| committer | Erik de Castro Lopo <erikd@mega-nerd.com> | 2016-07-14 18:42:05 +1000 |
| commit | a52177b0d1e79c5cc15ab7d3503bcd1bfb3fd54b (patch) | |
| tree | 5818f9fac864dfe63732437c1d4e457623fbde23 | |
| parent | f7491f9741a0fa2e623d321882b29a49c35596d8 (diff) | |
| download | flac-a52177b0d1e79c5cc15ab7d3503bcd1bfb3fd54b.tar.gz | |
stream_decoder: reset has_seek_table before read_metadata_seektable_()
If a seek table has already been read successfully, then the
has_seek_table flag is true. Now imagine the file comes with another
seek table, which doesn't make sense, but libFLAC accepts it happily.
If reading this second seek table fails (for example allocation
failure), read_metadata_seektable_() returns false, but the
has_seek_table flag is still true. If the calling application happens
to ignore this failure, and at some point tries to seek, the process
will crash due to NULL pointer dereference. This would sure be an
application bug that needs to be fixed, but libFLAC's internal state
is inconsistent, so let's fix this up.
Signed-off-by: Erik de Castro Lopo <erikd@mega-nerd.com>
| -rw-r--r-- | src/libFLAC/stream_decoder.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/src/libFLAC/stream_decoder.c b/src/libFLAC/stream_decoder.c index 8123c267..d364b0ce 100644 --- a/src/libFLAC/stream_decoder.c +++ b/src/libFLAC/stream_decoder.c @@ -1418,6 +1418,9 @@ FLAC__bool read_metadata_(FLAC__StreamDecoder *decoder) decoder->private_->metadata_callback(decoder, &decoder->private_->stream_info, decoder->private_->client_data); } else if(type == FLAC__METADATA_TYPE_SEEKTABLE) { + /* just in case we already have a seek table, and reading the next one fails: */ + decoder->private_->has_seek_table = false; + if(!read_metadata_seektable_(decoder, is_last, length)) return false; |