diff options
author | Anton Khirnov <anton@khirnov.net> | 2023-04-13 15:56:54 +0200 |
---|---|---|
committer | Anton Khirnov <anton@khirnov.net> | 2023-04-17 11:49:34 +0200 |
commit | 89c9a3ac3542c3684e511607d88b265bfa6aa64f (patch) | |
tree | 7969641e3755b37c9234eb37a9215b396fb0b11f | |
parent | 65e537b83379d2d6f87343f9bd59968b21d949a3 (diff) | |
download | ffmpeg-89c9a3ac3542c3684e511607d88b265bfa6aa64f.tar.gz |
fftools/ffmpeg: avoid possible invalid reads with short -tag values
Fixes #10319 and #10309.
-rw-r--r-- | fftools/ffmpeg_demux.c | 8 | ||||
-rw-r--r-- | fftools/ffmpeg_mux_init.c | 7 |
2 files changed, 11 insertions, 4 deletions
diff --git a/fftools/ffmpeg_demux.c b/fftools/ffmpeg_demux.c index b9849d1669..d89e28b9f6 100644 --- a/fftools/ffmpeg_demux.c +++ b/fftools/ffmpeg_demux.c @@ -736,8 +736,12 @@ static void add_input_streams(const OptionsContext *o, Demuxer *d) MATCH_PER_STREAM_OPT(codec_tags, str, codec_tag, ic, st); if (codec_tag) { uint32_t tag = strtol(codec_tag, &next, 0); - if (*next) - tag = AV_RL32(codec_tag); + if (*next) { + uint8_t buf[4] = { 0 }; + memcpy(buf, codec_tag, FFMIN(sizeof(buf), strlen(codec_tag))); + tag = AV_RL32(buf); + } + st->codecpar->codec_tag = tag; } diff --git a/fftools/ffmpeg_mux_init.c b/fftools/ffmpeg_mux_init.c index 62e5643a04..aab423464c 100644 --- a/fftools/ffmpeg_mux_init.c +++ b/fftools/ffmpeg_mux_init.c @@ -610,8 +610,11 @@ static OutputStream *new_output_stream(Muxer *mux, const OptionsContext *o, MATCH_PER_STREAM_OPT(codec_tags, str, codec_tag, oc, st); if (codec_tag) { uint32_t tag = strtol(codec_tag, &next, 0); - if (*next) - tag = AV_RL32(codec_tag); + if (*next) { + uint8_t buf[4] = { 0 }; + memcpy(buf, codec_tag, FFMIN(sizeof(buf), strlen(codec_tag))); + tag = AV_RL32(buf); + } ost->st->codecpar->codec_tag = tag; if (ost->enc_ctx) ost->enc_ctx->codec_tag = tag; |