aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAnton Khirnov <anton@khirnov.net>2023-04-13 15:56:54 +0200
committerAnton Khirnov <anton@khirnov.net>2023-04-17 12:08:46 +0200
commit8f61cbf1b9249a732b40fc26fc4f84e390f6e2d4 (patch)
tree3f6df321236eaa7708454ba947874387fb4d6b85
parent2c111647072af2f481c43ce923b13201c969745c (diff)
downloadffmpeg-8f61cbf1b9249a732b40fc26fc4f84e390f6e2d4.tar.gz
fftools/ffmpeg: avoid possible invalid reads with short -tag values
Fixes #10319 and #10309. (cherry picked from commit 89c9a3ac3542c3684e511607d88b265bfa6aa64f) Signed-off-by: Anton Khirnov <anton@khirnov.net>
-rw-r--r--fftools/ffmpeg_demux.c8
-rw-r--r--fftools/ffmpeg_mux_init.c7
2 files changed, 11 insertions, 4 deletions
diff --git a/fftools/ffmpeg_demux.c b/fftools/ffmpeg_demux.c
index ffece60720..938ec09e3d 100644
--- a/fftools/ffmpeg_demux.c
+++ b/fftools/ffmpeg_demux.c
@@ -628,8 +628,12 @@ static void add_input_streams(const OptionsContext *o, Demuxer *d)
MATCH_PER_STREAM_OPT(codec_tags, str, codec_tag, ic, st);
if (codec_tag) {
uint32_t tag = strtol(codec_tag, &next, 0);
- if (*next)
- tag = AV_RL32(codec_tag);
+ if (*next) {
+ uint8_t buf[4] = { 0 };
+ memcpy(buf, codec_tag, FFMIN(sizeof(buf), strlen(codec_tag)));
+ tag = AV_RL32(buf);
+ }
+
st->codecpar->codec_tag = tag;
}
diff --git a/fftools/ffmpeg_mux_init.c b/fftools/ffmpeg_mux_init.c
index 09d24ba8e5..e42d5ff26a 100644
--- a/fftools/ffmpeg_mux_init.c
+++ b/fftools/ffmpeg_mux_init.c
@@ -606,8 +606,11 @@ static OutputStream *new_output_stream(Muxer *mux, const OptionsContext *o,
MATCH_PER_STREAM_OPT(codec_tags, str, codec_tag, oc, st);
if (codec_tag) {
uint32_t tag = strtol(codec_tag, &next, 0);
- if (*next)
- tag = AV_RL32(codec_tag);
+ if (*next) {
+ uint8_t buf[4] = { 0 };
+ memcpy(buf, codec_tag, FFMIN(sizeof(buf), strlen(codec_tag)));
+ tag = AV_RL32(buf);
+ }
ost->st->codecpar->codec_tag = tag;
if (ost->enc_ctx)
ost->enc_ctx->codec_tag = tag;