Fix possible array index crashes in multitrack and transition.

Reported by JBM.
mltframework · Jan 13, 2016 · dd12f73 · dd12f73
1 parent 8d6817d
commit dd12f73
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 4 deletions.
diff --git a/src/framework/mlt_multitrack.c b/src/framework/mlt_multitrack.c
@@ -3,7 +3,7 @@
  * \brief multitrack service class
  * \see mlt_multitrack_s
  *
- * Copyright (C) 2003-2015 Meltytech, LLC
+ * Copyright (C) 2003-2016 Meltytech, LLC
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
@@ -364,7 +364,7 @@ mlt_producer mlt_multitrack_track( mlt_multitrack self, int track )
 {
 	mlt_producer producer = NULL;
 
-	if ( self->list != NULL && track < self->count )
+	if ( self->list != NULL && track >= 0 && track < self->count )
 		producer = self->list[ track ]->producer;
 
 	return producer;
@@ -548,7 +548,7 @@ static int producer_get_frame( mlt_producer parent, mlt_frame_ptr frame, int ind
 	mlt_multitrack self = parent->child;
 
 	// Check if we have a track for this index
-	if ( index < self->count && self->list[ index ] != NULL )
+	if ( index >= 0 && index < self->count && self->list[ index ] != NULL )
 	{
 		// Get the producer for this track
 		mlt_producer producer = self->list[ index ]->producer;

diff --git a/src/framework/mlt_transition.c b/src/framework/mlt_transition.c
@@ -3,7 +3,7 @@
  * \brief abstraction for all transition services
  * \see mlt_transition_s
  *
- * Copyright (C) 2003-2015 Meltytech, LLC
+ * Copyright (C) 2003-2016 Meltytech, LLC
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
@@ -427,6 +427,8 @@ static int transition_get_frame( mlt_service service, mlt_frame_ptr frame, int i
 		a_track = b_track;
 		b_track = mlt_properties_get_int( properties, "a_track" );
 	}
+	a_track = a_track < 0 ? 0 : a_track;
+	b_track = b_track < 0 ? 0 : b_track;
 
 	// Only act on this operation once per multitrack iteration from the tractor
 	if ( !self->held )