[PATCH] fixed #1978

Gbp-Pq: Name CVE-2021-45762.patch

diff --git a/src/bifs/com_dec.c b/src/bifs/com_dec.c
index ea63580290691e662cd9456a6151e1a544fcdc9f..7b0a1ed421051df357eb24b143d50f82fb9e268c 100644 (file)
--- a/src/bifs/com_dec.c
+++ b/src/bifs/com_dec.c
@@ -807,7 +807,8 @@ static GF_Err BD_DecFieldReplace(GF_BifsDecoder * codec, GF_BitStream *bs)
        }
        /*regular field*/
        else if (!gf_sg_vrml_is_sf_field(field.fieldType)) {
-               gf_sg_vrml_mf_reset(field.far_ptr, field.fieldType);
+               e = gf_sg_vrml_mf_reset(field.far_ptr, field.fieldType);
+               if (e) return e;
        }
 
        /*parse the field*/

diff --git a/src/bifs/field_decode.c b/src/bifs/field_decode.c
index b06a87208e6e770b166ff57e96072ae42a5ecca0..8527d5903dfabf89ad16631c4d253f9269856da4 100644 (file)
--- a/src/bifs/field_decode.c
+++ b/src/bifs/field_decode.c
@@ -498,7 +498,8 @@ GF_Err gf_bifs_dec_field(GF_BifsDecoder * codec, GF_BitStream *bs, GF_Node *node
                                * (GF_ChildNodeItem **)field->far_ptr = NULL;
                        } else {
                                //remove all items of the MFField
-                               gf_sg_vrml_mf_reset(field->far_ptr, field->fieldType);
+                               e = gf_sg_vrml_mf_reset(field->far_ptr, field->fieldType);
+                               if (e) return e;
                        }
                }
 
@@ -530,7 +531,7 @@ GF_Err gf_bifs_dec_field(GF_BifsDecoder * codec, GF_BitStream *bs, GF_Node *node
                        } else {
                                e = BD_DecMFFieldVec(codec, bs, node, field, is_mem_com);
                        }
-                       if (e) return e;
+                       if (e) return codec->LastError = e;
                }
        }
        return GF_OK;

diff --git a/src/scenegraph/vrml_tools.c b/src/scenegraph/vrml_tools.c
index 26bec0ead07867a6ae22200ac2b891f7bc8da620..5c0852eefc7413899573a84c02ff0b5719604dda 100644 (file)
--- a/src/scenegraph/vrml_tools.c
+++ b/src/scenegraph/vrml_tools.c
@@ -1119,7 +1119,7 @@ GF_EXPORT
 GF_Err gf_sg_vrml_mf_reset(void *mf, u32 FieldType)
 {
        GenMFField *mffield = (GenMFField *)mf;
-       if (!mffield->array) return GF_OK;
+       if (!mffield || !mffield->array) return GF_OK;
 
        //field we can't copy
        if (gf_sg_vrml_is_sf_field(FieldType)) return GF_BAD_PARAM;