diff options
| author | Anton Khirnov <anton@khirnov.net> | 2023-04-13 15:56:54 +0200 |
|---|---|---|
| committer | Anton Khirnov <anton@khirnov.net> | 2023-04-17 12:08:46 +0200 |
| commit | 8f61cbf1b9249a732b40fc26fc4f84e390f6e2d4 (patch) | |
| tree | 3f6df321236eaa7708454ba947874387fb4d6b85 | |
| parent | 2c111647072af2f481c43ce923b13201c969745c (diff) | |
| download | ffmpeg-8f61cbf1b9249a732b40fc26fc4f84e390f6e2d4.tar.gz | |
fftools/ffmpeg: avoid possible invalid reads with short -tag values
Fixes #10319 and #10309.
(cherry picked from commit 89c9a3ac3542c3684e511607d88b265bfa6aa64f)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
| -rw-r--r-- | fftools/ffmpeg_demux.c | 8 | ||||
| -rw-r--r-- | fftools/ffmpeg_mux_init.c | 7 |
2 files changed, 11 insertions, 4 deletions
diff --git a/fftools/ffmpeg_demux.c b/fftools/ffmpeg_demux.c index ffece60720..938ec09e3d 100644 --- a/fftools/ffmpeg_demux.c +++ b/fftools/ffmpeg_demux.c @@ -628,8 +628,12 @@ static void add_input_streams(const OptionsContext *o, Demuxer *d) MATCH_PER_STREAM_OPT(codec_tags, str, codec_tag, ic, st); if (codec_tag) { uint32_t tag = strtol(codec_tag, &next, 0); - if (*next) - tag = AV_RL32(codec_tag); + if (*next) { + uint8_t buf[4] = { 0 }; + memcpy(buf, codec_tag, FFMIN(sizeof(buf), strlen(codec_tag))); + tag = AV_RL32(buf); + } + st->codecpar->codec_tag = tag; } diff --git a/fftools/ffmpeg_mux_init.c b/fftools/ffmpeg_mux_init.c index 09d24ba8e5..e42d5ff26a 100644 --- a/fftools/ffmpeg_mux_init.c +++ b/fftools/ffmpeg_mux_init.c @@ -606,8 +606,11 @@ static OutputStream *new_output_stream(Muxer *mux, const OptionsContext *o, MATCH_PER_STREAM_OPT(codec_tags, str, codec_tag, oc, st); if (codec_tag) { uint32_t tag = strtol(codec_tag, &next, 0); - if (*next) - tag = AV_RL32(codec_tag); + if (*next) { + uint8_t buf[4] = { 0 }; + memcpy(buf, codec_tag, FFMIN(sizeof(buf), strlen(codec_tag))); + tag = AV_RL32(buf); + } ost->st->codecpar->codec_tag = tag; if (ost->enc_ctx) ost->enc_ctx->codec_tag = tag; |