Bug Hunter Diary

So, what library function is called after the arbitrary memorywrites? To answer this question, I had a look at the source code again:Source code file libavformat/4xm.cFunctionfourxm_read_header()[..]184 /* allocate a new AVStream */185 st = av_new_stream(s, current_track);[..]Directly after the four memory-write operations, a new AVStream isallocated using the function av_new_stream().Source code file libavformat/utils.cFunction av_new_stream()[..]2271 AVStream *av_new_stream(AVFormatContext *s, int id)2272 {2273 AVStream *st;2274 int i;22752276 if (s->nb_streams >= MAX_STREAMS)2277 return NULL;22782279 st = av_mallocz(sizeof(AVStream));[..]In line 2279 another function named av_mallocz() is called.Source code file libavutil/mem.cFunctions av_mallocz() and av_malloc()[..]43 void *av_malloc(unsigned int size)44 {45 void *ptr = NULL;46 #ifdef CONFIG_MEMALIGN_HACK47 long diff;48 #endif4950 /* let's disallow possible ambiguous cases */51 if(size > (INT_MAX-16) )52 return NULL;5354 #ifdef CONFIG_MEMALIGN_HACK55 ptr = malloc(size+16);56 if(!ptr)57 return ptr;58 diff= ((-(long)ptr - 1)&15) + 1;59 ptr = (char*)ptr + diff;60 ((char*)ptr)[-1]= diff;61 #elif defined (HAVE_POSIX_MEMALIGN)62 posix_memalign(&ptr,16,size);62 Chapter 4