diff options
| author | wm4 <wm4@nowhere> | 2014-03-26 17:07:53 +0100 |
|---|---|---|
| committer | wm4 <wm4@nowhere> | 2014-03-30 17:54:30 +0200 |
| commit | 6e2c29b78658ac7193f90f5745d8312a5ac10e0f (patch) | |
| tree | 92e42d9c11e87c7c930021f210ab395d0f6ab031 | |
| parent | e565217f22bf947552b866ff8b9a033d4fa2d65a (diff) | |
| download | mpv-6e2c29b78658ac7193f90f5745d8312a5ac10e0f.tar.bz2 mpv-6e2c29b78658ac7193f90f5745d8312a5ac10e0f.tar.xz | |
player: fix unchecked access for chapter metadata
It's possible that MPContext has a chapter list, but the demuxer
doesn't. In this case, accesing the chapter-metadata property would
lead to invalid accesses.
(This fixes the out of bound access, but in theory, the returned data
can still be incorrect, since MPContext chapters don't need to map
directly to demuxer chapters.)
| -rw-r--r-- | player/command.c | 4 |
1 files changed, 1 insertions, 3 deletions
diff --git a/player/command.c b/player/command.c index a1cecb6f2b..09022f2150 100644 --- a/player/command.c +++ b/player/command.c @@ -750,11 +750,9 @@ static int mp_property_chapter_metadata(m_option_t *prop, int action, void *arg, { struct demuxer *demuxer = mpctx->master_demuxer; int chapter = get_current_chapter(mpctx); - if (!demuxer || chapter < 0) + if (!demuxer || chapter < 0 || chapter >= demuxer->num_chapters) return M_PROPERTY_UNAVAILABLE; - assert(chapter < demuxer->num_chapters); - return tag_property(prop, action, arg, demuxer->chapters[chapter].metadata); } |