Ticket #9828: 0001-Fix-for-double-free-in-libdvdnav-taken-from-dvdnav-s.patch

File 0001-Fix-for-double-free-in-libdvdnav-taken-from-dvdnav-s.patch, 2.3 KB (added by linux@…, 13 years ago)

patch for double free in dvdnav, based on upstream SVN commit 1220

  • mythtv/libs/libmythdvdnav/dvdread/ifo_read.c 

    From 0ee0a5832cf47993d9e09d71ce46c76f6363340e Mon Sep 17 00:00:00 2001
From: Martin Kittel <linux@martin-kittel.de>
Date: Wed, 1 Jun 2011 21:22:49 +0200
Subject: [PATCH] Fix for double free in libdvdnav, taken from dvdnav svn 1220

This patch improves slightly on the upstream version and fixes a tiny
memory leak that would leave the already processed ptl_mait info unfreed
in some cases.
---
 mythtv/libs/libmythdvdnav/dvdread/ifo_read.c |   10 ++++++++--
 1 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/mythtv/libs/libmythdvdnav/dvdread/ifo_read.c b/mythtv/libs/libmythdvdnav/dvdread/ifo_read.c
index b94ac35..dc1afdf 100644
    a b int ifoRead_PTL_MAIT(ifo_handle_t *ifofile) { 
    13251325    ifofile->ptl_mait = 0;
    13261326    return 0;
    13271327  }
     1328  for(i = 0; i < ptl_mait->nr_of_countries; i++) {
     1329    ptl_mait->countries[i].pf_ptl_mai = NULL;
     1330  }
    13281331
    13291332  for(i = 0; i < ptl_mait->nr_of_countries; i++) {
    13301333    if(!(DVDReadBytes(ifofile->file, &ptl_mait->countries[i], PTL_MAIT_COUNTRY_SIZE))) {
    … … int ifoRead_PTL_MAIT(ifo_handle_t *ifofile) { 
    13551358                     ifofile->vmgi_mat->ptl_mait * DVD_BLOCK_LEN
    13561359                     + ptl_mait->countries[i].pf_ptl_mai_start_byte)) {
    13571360      fprintf(stderr, "libdvdread: Unable to seek PTL_MAIT table.\n");
    1358       free(ptl_mait->countries);
    1359       free(ptl_mait);
     1361      free_ptl_mait(ptl_mait, i);
     1362      ifofile->ptl_mait = NULL;
    13601363      return 0;
    13611364    }
    13621365    info_length = (ptl_mait->nr_of_vtss + 1) * sizeof(pf_level_t);
    13631366    pf_temp = (uint16_t *)malloc(info_length);
    13641367    if(!pf_temp) {
    13651368      free_ptl_mait(ptl_mait, i);
     1369      ifofile->ptl_mait = NULL;
    13661370      return 0;
    13671371    }
    13681372    if(!(DVDReadBytes(ifofile->file, pf_temp, info_length))) {
    13691373      fprintf(stderr, "libdvdread: Unable to read PTL_MAIT table.\n");
    13701374      free(pf_temp);
    13711375      free_ptl_mait(ptl_mait, i);
     1376      ifofile->ptl_mait = NULL;
    13721377      return 0;
    13731378    }
    13741379    for (j = 0; j < ((ptl_mait->nr_of_vtss + 1) * 8); j++) {
    … … int ifoRead_PTL_MAIT(ifo_handle_t *ifofile) { 
    13781383    if(!ptl_mait->countries[i].pf_ptl_mai) {
    13791384      free(pf_temp);
    13801385      free_ptl_mait(ptl_mait, i);
     1386      ifofile->ptl_mait = NULL;
    13811387      return 0;
    13821388    }
    13831389    { /* Transpose the array so we can use C indexing. */