virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-03-28 12:32:17 +02:00
Code Issues Releases Activity

avformat/webmdashenc: Check id in adaption_sets

Browse Source 
Fixes: out of array access

Found-by: Wenxiang Qian
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2019-02-13 10:15:04 +01:00
parent 85f91ed760
commit b687b549aa
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libavformat/webmdashenc.c
View File

@ -466,6 +466,7 @@ static int parse_adaptation_sets(AVFormatContext *s)
continue; continue;
else if (state == new_set && !strncmp(p, "id=", 3)) { else if (state == new_set && !strncmp(p, "id=", 3)) {
void *mem = av_realloc(w->as, sizeof(*w->as) * (w->nb_as + 1)); void *mem = av_realloc(w->as, sizeof(*w->as) * (w->nb_as + 1));
const char *comma;
if (mem == NULL) if (mem == NULL)
return AVERROR(ENOMEM); return AVERROR(ENOMEM);
w->as = mem; w->as = mem;
@ -474,6 +475,11 @@ static int parse_adaptation_sets(AVFormatContext *s)
w->as[w->nb_as - 1].streams = NULL; w->as[w->nb_as - 1].streams = NULL;
p += 3; // consume "id=" p += 3; // consume "id="
q = w->as[w->nb_as - 1].id; q = w->as[w->nb_as - 1].id;
comma = strchr(p, ',');
if (!comma || comma - p >= sizeof(w->as[w->nb_as - 1].id)) {
av_log(s, AV_LOG_ERROR, "'id' in 'adaptation_sets' is malformed.\n");
return AVERROR(EINVAL);
}
while (*p != ',') *q++ = *p++; while (*p != ',') *q++ = *p++;
*q = 0; *q = 0;
p++; p++;