diff options
| author | Andreas Rheinhardt <andreas.rheinhardt@outlook.com> | 2022-09-28 19:38:01 +0200 |
|---|---|---|
| committer | Andreas Rheinhardt <andreas.rheinhardt@outlook.com> | 2022-10-04 18:01:01 +0200 |
| commit | 63b31565584e7aaef9c43ca9c0c7a44c6cbc9e97 (patch) | |
| tree | 4d91dcb8e61091b104973f5b269b2fd2b4fbeb16 | |
| parent | e95fdf7660a4a5045eece116d8915be485aef6c1 (diff) | |
| download | ffmpeg-63b31565584e7aaef9c43ca9c0c7a44c6cbc9e97.tar.gz | |
avformat/aviobuf: Don't use NULL as src for memcpy
This might happen in avio_write() if size == 0
when the direct codepath is taken. It is undefined behaviour
according to the spec although it happens to work in practice.
Fixes the webm-webvtt-remux FATE-test under UBSan.
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
| -rw-r--r-- | libavformat/aviobuf.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/libavformat/aviobuf.c b/libavformat/aviobuf.c index b20b1a611a..257535a964 100644 --- a/libavformat/aviobuf.c +++ b/libavformat/aviobuf.c @@ -231,12 +231,14 @@ void ffio_fill(AVIOContext *s, int b, int64_t count) void avio_write(AVIOContext *s, const unsigned char *buf, int size) { + if (size <= 0) + return; if (s->direct && !s->update_checksum) { avio_flush(s); writeout(s, buf, size); return; } - while (size > 0) { + do { int len = FFMIN(s->buf_end - s->buf_ptr, size); memcpy(s->buf_ptr, buf, len); s->buf_ptr += len; @@ -246,7 +248,7 @@ void avio_write(AVIOContext *s, const unsigned char *buf, int size) buf += len; size -= len; - } + } while (size > 0); } void avio_flush(AVIOContext *s) |