From 0a9a2257339c8697be31e64b36fa6208132b11bd Mon Sep 17 00:00:00 2001 From: Samuel Pitoiset Date: Mon, 11 Jun 2012 14:21:32 +0200 Subject: [PATCH] rtmp: Fix a possible access to invalid memory location when the playpath is too short. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Martin Storsjö --- libavformat/rtmpproto.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavformat/rtmpproto.c b/libavformat/rtmpproto.c index e9a3e4336e..56011f1cde 100644 --- a/libavformat/rtmpproto.c +++ b/libavformat/rtmpproto.c @@ -1141,11 +1141,11 @@ static int rtmp_open(URLContext *s, const char *uri, int flags) goto fail; } - if (!strchr(fname, ':') && + if (!strchr(fname, ':') && len >= 4 && (!strcmp(fname + len - 4, ".f4v") || !strcmp(fname + len - 4, ".mp4"))) { memcpy(rt->playpath, "mp4:", 5); - } else if (!strcmp(fname + len - 4, ".flv")) { + } else if (len >= 4 && !strcmp(fname + len - 4, ".flv")) { fname[len - 4] = '\0'; } else { rt->playpath[0] = 0;