[FFmpeg-devel] [PATCH] mjpegdec: Do not assume unused plane pointer are NULL.

[Michael Niedermayer]

On Fri, Feb 26, 2016 at 12:15:19AM +0100, Reimar Döffinger wrote:
> We do neither document nor check such a requirement
> and for application-provided get_buffer2 they could
> contain the result of a malloc(0) or whatever value
> they had previously.
> This fixes a use-after-free in e.g. MPlayer:
> https://trac.mplayerhq.hu/ticket/2262
> We might want to consider changing the (documented)
> API in addition though.
> 
> Signed-off-by: Reimar Döffinger <Reimar.Doeffinger at gmx.de>
> ---
>  libavcodec/mjpegdec.c | 8 +++++---
>  1 file changed, 5 insertions(+), 3 deletions(-)

the assumtation that unused plane pointers are NULL is more
widespread than mjpeg i think

also, is it really a good idea to leave stale pointers in the array?

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Rewriting code that is poorly written but fully understood is good.
Rewriting code that one doesnt understand is a sign that one is less smart
then the original author, trying to rewrite it will not make it better.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: Digital signature
URL: <http://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20160226/a0b879e9/attachment.sig>