[Mplayerxp-cvslog] SF.net SVN: mplayerxp:[365] mplayerxp

[<nic...@us...>]

Revision: 365
          http://mplayerxp.svn.sourceforge.net/mplayerxp/?rev=365&view=rev
Author:   nickols_k
Date:     2012-11-14 10:16:57 +0000 (Wed, 14 Nov 2012)
Log Message:
-----------
remove some security holes

Modified Paths:
--------------
    mplayerxp/libmpdemux/demuxer.c
    mplayerxp/libmpdemux/stream.c
    mplayerxp/postproc/af.c
    mplayerxp/postproc/vf.c

Modified: mplayerxp/libmpdemux/demuxer.c
===================================================================
--- mplayerxp/libmpdemux/demuxer.c	2012-11-14 09:58:47 UTC (rev 364)
+++ mplayerxp/libmpdemux/demuxer.c	2012-11-14 10:16:57 UTC (rev 365)
@@ -115,7 +115,7 @@
 
 demux_stream_t* new_demuxer_stream(struct demuxer_s *demuxer,int id){
   demux_stream_t* ds=mp_malloc(sizeof(demux_stream_t));
-  RND_RENAME0(rnd_fill)(ds->antiviral_hole,sizeof(ds->antiviral_hole));
+  RND_RENAME0(rnd_fill)(ds->antiviral_hole,offsetof(struct demuxer_s,pin)-offsetof(struct demuxer_s,antiviral_hole));
   ds->pin=DS_PIN;
   ds->buffer_pos=ds->buffer_size=0;
   ds->buffer=NULL;
@@ -143,7 +143,7 @@
 
 demuxer_t* new_demuxer(stream_t *stream,int type,int a_id,int v_id,int s_id){
   demuxer_t *d=mp_mallocz(sizeof(demuxer_t));
-  RND_RENAME0(rnd_fill)(d->antiviral_hole,sizeof(d->antiviral_hole));
+  RND_RENAME0(rnd_fill)(d->antiviral_hole,offsetof(demuxer_t,pin)-offsetof(demuxer_t,antiviral_hole));
   d->pin=DEMUX_PIN;
   d->stream=stream;
   d->movi_start=stream->start_pos;

Modified: mplayerxp/libmpdemux/stream.c
===================================================================
--- mplayerxp/libmpdemux/stream.c	2012-11-14 09:58:47 UTC (rev 364)
+++ mplayerxp/libmpdemux/stream.c	2012-11-14 10:16:57 UTC (rev 365)
@@ -239,7 +239,7 @@
   stream_t *s=mp_mallocz(sizeof(stream_t));
   if(s==NULL) return NULL;
 
-  RND_RENAME0(rnd_fill)(s->antiviral_hole,sizeof(s->antiviral_hole));
+  RND_RENAME0(rnd_fill)(s->antiviral_hole,offsetof(stream_t,pin)-offsetof(stream_t,antiviral_hole));
   s->pin=STREAM_PIN;
   s->fd=-1;
   s->type=type;

Modified: mplayerxp/postproc/af.c
===================================================================
--- mplayerxp/postproc/af.c	2012-11-14 09:58:47 UTC (rev 364)
+++ mplayerxp/postproc/af.c	2012-11-14 10:16:57 UTC (rev 365)
@@ -120,7 +120,7 @@
     MSG_ERR(MSGTR_OutOfMemory);
     return NULL;
   }
-  RND_RENAME0(rnd_fill)(_new->antiviral_hole,sizeof(_new->antiviral_hole));
+  RND_RENAME0(rnd_fill)(_new->antiviral_hole,offsetof(af_instance_t,pin)-offsetof(af_instance_t,antiviral_hole));
   _new->pin=AF_PIN;
   _new->parent=s;
   // Check for commandline parameters

Modified: mplayerxp/postproc/vf.c
===================================================================
--- mplayerxp/postproc/vf.c	2012-11-14 09:58:47 UTC (rev 364)
+++ mplayerxp/postproc/vf.c	2012-11-14 10:16:57 UTC (rev 365)
@@ -297,7 +297,7 @@
 	if(!strcmp(filter_list[i]->name,name)) break;
     }
     vf=mp_mallocz(sizeof(vf_instance_t));
-    RND_RENAME0(rnd_fill)(vf->antiviral_hole,sizeof(vf->antiviral_hole));
+    RND_RENAME0(rnd_fill)(vf->antiviral_hole,offsetof(vf_instance_t,pin)-offsetof(vf_instance_t,antiviral_hole));
     vf->pin=VF_PIN;
     vf->info=filter_list[i];
     vf->next=next;

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.