Skip to content
  • James Cowgill's avatar
    Fix free of uninitialized memory if seek fails in ov_raw_seek · 128f0f81
    James Cowgill authored and Thomas Daede's avatar Thomas Daede committed
    If _seek_helper fails in ov_raw_seek, control jumps to the seek_error
    label which calls ogg_stream_clear on work_os. However, at this point
    in the function, work_os is not initialized so we end up attempting to
    free some uninitialized memory and crashing.
    
    Fix by removing the call to ogg_stream_clear. This is safe because the
    only code path to seek_error happens before work_os is initialized (so
    there is never anything to free anyway).
    
    I also refactor the code a bit:
    - Remove the ret variable which is unnessesary since we can just pass
      the result of _seek_helper directly to the if.
    - Since seek_error is only used once, move the contents of that block
      to the if statement so we can remove a goto.
    128f0f81