Fix null pointer dereference
Fixes Ticket2588
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
... | ... |
@@ -95,13 +95,14 @@ static int rm_read_extradata(AVIOContext *pb, AVCodecContext *avctx, unsigned si |
95 | 95 |
return 0; |
96 | 96 |
} |
97 | 97 |
|
98 |
-static void rm_read_metadata(AVFormatContext *s, int wide) |
|
98 |
+static void rm_read_metadata(AVFormatContext *s, AVIOContext *pb, int wide) |
|
99 | 99 |
{ |
100 | 100 |
char buf[1024]; |
101 | 101 |
int i; |
102 |
+ |
|
102 | 103 |
for (i=0; i<FF_ARRAY_ELEMS(ff_rm_metadata); i++) { |
103 |
- int len = wide ? avio_rb16(s->pb) : avio_r8(s->pb); |
|
104 |
- get_strl(s->pb, buf, sizeof(buf), len); |
|
104 |
+ int len = wide ? avio_rb16(pb) : avio_r8(pb); |
|
105 |
+ get_strl(pb, buf, sizeof(buf), len); |
|
105 | 106 |
av_dict_set(&s->metadata, ff_rm_metadata[i], buf, 0); |
106 | 107 |
} |
107 | 108 |
} |
... | ... |
@@ -134,7 +135,7 @@ static int rm_read_audio_stream_info(AVFormatContext *s, AVIOContext *pb, |
134 | 134 |
avio_skip(pb, 8); |
135 | 135 |
bytes_per_minute = avio_rb16(pb); |
136 | 136 |
avio_skip(pb, 4); |
137 |
- rm_read_metadata(s, 0); |
|
137 |
+ rm_read_metadata(s, pb, 0); |
|
138 | 138 |
if ((startpos + header_size) >= avio_tell(pb) + 2) { |
139 | 139 |
// fourcc (should always be "lpcJ") |
140 | 140 |
avio_r8(pb); |
... | ... |
@@ -293,7 +294,7 @@ static int rm_read_audio_stream_info(AVFormatContext *s, AVIOContext *pb, |
293 | 293 |
avio_r8(pb); |
294 | 294 |
avio_r8(pb); |
295 | 295 |
avio_r8(pb); |
296 |
- rm_read_metadata(s, 0); |
|
296 |
+ rm_read_metadata(s, pb, 0); |
|
297 | 297 |
} |
298 | 298 |
} |
299 | 299 |
return 0; |
... | ... |
@@ -516,7 +517,7 @@ static int rm_read_header(AVFormatContext *s) |
516 | 516 |
flags = avio_rb16(pb); /* flags */ |
517 | 517 |
break; |
518 | 518 |
case MKTAG('C', 'O', 'N', 'T'): |
519 |
- rm_read_metadata(s, 1); |
|
519 |
+ rm_read_metadata(s, pb, 1); |
|
520 | 520 |
break; |
521 | 521 |
case MKTAG('M', 'D', 'P', 'R'): |
522 | 522 |
st = avformat_new_stream(s, NULL); |