[MPlayer-cvslog] r37660 - trunk/libmpdemux/demux_ogg.c

[reimar]

Author: reimar
Date: Wed Feb 10 22:52:22 2016
New Revision: 37660

Log:
demux_ogg: avoid negative memcpy length.

Fixes a Coverity issue.

Modified:
   trunk/libmpdemux/demux_ogg.c

Modified: trunk/libmpdemux/demux_ogg.c
==============================================================================
--- trunk/libmpdemux/demux_ogg.c	Wed Feb 10 22:48:07 2016	(r37659)
+++ trunk/libmpdemux/demux_ogg.c	Wed Feb 10 22:52:22 2016	(r37660)
@@ -1301,7 +1301,7 @@ static int demux_ogg_fill_buffer(demuxer
 demuxer_t *init_avi_with_ogg(demuxer_t *demuxer)
 {
     demuxer_t *od;
-    ogg_demuxer_t *ogg_d;
+    ogg_demuxer_t *ogg_d = NULL;
     stream_t *s;
     uint32_t hdrsizes[3];
     demux_packet_t *dp;
@@ -1347,11 +1347,15 @@ demuxer_t *init_avi_with_ogg(demuxer_t *
         if (np < 0) {
             mp_msg(MSGT_DEMUX, MSGL_ERR,
                    "AVI Ogg error : Can't init using first stream packets\n");
-            free(ogg_d);
             goto fallback;
         }
         // Add some data
         plen = ds_get_packet(demuxer->audio, &p);
+        if (plen < 0) {
+            mp_msg(MSGT_DEMUX, MSGL_ERR,
+                   "AVI Ogg error : Invalid first stream packets\n");
+            goto fallback;
+        }
         buf  = ogg_sync_buffer(&ogg_d->sync, plen);
         memcpy(buf, p, plen);
         ogg_sync_wrote(&ogg_d->sync, plen);
@@ -1389,6 +1393,7 @@ demuxer_t *init_avi_with_ogg(demuxer_t *
     return new_demuxers_demuxer(demuxer, od, demuxer);
 
 fallback:
+    free(ogg_d);
     demuxer->audio->id = -2;
     return demuxer;