[gst-devel] [PATCH] flvmux: fix duration metadata tag offset

[Andrzej K. Haczewski]

Former offset was wrong, but wasn't detected because of huge index
buffer is allocated before. For streamable FLV with no index buffer
the duration was written outside allocated memory leading to heap
corruption, nasty *** glibc detected *** free(): invalid pointer
warnings and segfaults.

Signed-off-by: Andrzej K. Haczewski <ahaczewski at gmail.com>
---
 gst/flv/gstflvmux.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/gst/flv/gstflvmux.c b/gst/flv/gstflvmux.c
index 2cba5f3..a4c8365 100644
--- a/gst/flv/gstflvmux.c
+++ b/gst/flv/gstflvmux.c
@@ -764,7 +764,7 @@ gst_flv_mux_create_metadata (GstFlvMux * mux)
 
     GST_DEBUG_OBJECT (mux, "determined the duration to be %f", d);
     data = GST_BUFFER_DATA (script_tag);
-    GST_WRITE_DOUBLE_BE (data + 42 + 2 + 8, d);
+    GST_WRITE_DOUBLE_BE (data + 29 + 2 + 8 + 1, d);
   }
 
   if (mux->have_video) {
-- 
1.7.0.1