diff options
author | Adam Richter <adamrichter4@gmail.com> | 2019-05-12 05:03:25 -0700 |
---|---|---|
committer | Michael Niedermayer <michael@niedermayer.cc> | 2019-12-02 19:41:48 +0100 |
commit | b55cf5f53d3ee1619314d8a43f7a34e203d7969f (patch) | |
tree | 658fa4412eaf7ef892002a0d1b8e99e8e249badf | |
parent | 332de4c1e42e342451bc3d744466f8dc45125282 (diff) | |
download | ffmpeg-b55cf5f53d3ee1619314d8a43f7a34e203d7969f.tar.gz |
libswcale: Fix possible string overflow in test.
In libswcale/tests/swcale.c, the function fileTest() calls sscanf in
an argument of "%12s" on character srcStr[] and dstStr[], which are
only 12 bytes. So, if the input string is 12 characters, a
terminating null byte can be written past the end of these arrays.
This bug was found by cppcheck.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b8ed4930618b170de57a9086e1e9892216454684)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-rw-r--r-- | libswscale/swscale-test.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libswscale/swscale-test.c b/libswscale/swscale-test.c index 45e25a378c..856e5cb346 100644 --- a/libswscale/swscale-test.c +++ b/libswscale/swscale-test.c @@ -297,10 +297,10 @@ static int fileTest(uint8_t *ref[4], int refStride[4], int w, int h, FILE *fp, while (fgets(buf, sizeof(buf), fp)) { struct Results r; enum AVPixelFormat srcFormat; - char srcStr[12]; + char srcStr[13]; int srcW = 0, srcH = 0; enum AVPixelFormat dstFormat; - char dstStr[12]; + char dstStr[13]; int dstW = 0, dstH = 0; int flags; int ret; |