diff options
| author | Andreas Rheinhardt <andreas.rheinhardt@outlook.com> | 2023-08-06 09:52:30 +0200 |
|---|---|---|
| committer | Andreas Rheinhardt <andreas.rheinhardt@outlook.com> | 2023-08-10 08:55:05 +0200 |
| commit | c4f35ba8084f254afe1fb05202abfdcfff63b854 (patch) | |
| tree | d28ed95bee6c89ea9fd428b0392890614157d413 | |
| parent | 8bea4a83aac0cb888ca72af9b823d4b68f40696e (diff) | |
| download | ffmpeg-c4f35ba8084f254afe1fb05202abfdcfff63b854.tar.gz | |
avutil/channel_layout: Account for \0 in sizes
av_channel_name(), av_channel_description() and
av_channel_layout_describe() are supposed to return the size
of the needed buffer to allow the user to check for truncation;
the documentation ("If the returned value is bigger than buf_size,
then the string was truncated.") confirms that size does not
mean strlen.
Yet the AVBPrint API, i.e. AVBPrint.len, does not account for
the terminating '\0'. Therefore the returned length is off by one.
Furthermore, also check for whether the returned value actually
fits in an int (which is the return value of these functions).
Reviewed-by: Nicolas George <george@nsup.org>
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
| -rw-r--r-- | libavutil/channel_layout.c | 12 | ||||
| -rw-r--r-- | libavutil/version.h | 2 |
2 files changed, 10 insertions, 4 deletions
diff --git a/libavutil/channel_layout.c b/libavutil/channel_layout.c index e2f7512254..9b581ae6b3 100644 --- a/libavutil/channel_layout.c +++ b/libavutil/channel_layout.c @@ -108,7 +108,9 @@ int av_channel_name(char *buf, size_t buf_size, enum AVChannel channel_id) av_bprint_init_for_buffer(&bp, buf, buf_size); av_channel_name_bprint(&bp, channel_id); - return bp.len; + if (bp.len >= INT_MAX) + return AVERROR(ERANGE); + return bp.len + 1; } void av_channel_description_bprint(AVBPrint *bp, enum AVChannel channel_id) @@ -135,7 +137,9 @@ int av_channel_description(char *buf, size_t buf_size, enum AVChannel channel_id av_bprint_init_for_buffer(&bp, buf, buf_size); av_channel_description_bprint(&bp, channel_id); - return bp.len; + if (bp.len >= INT_MAX) + return AVERROR(ERANGE); + return bp.len + 1; } enum AVChannel av_channel_from_string(const char *str) @@ -789,7 +793,9 @@ int av_channel_layout_describe(const AVChannelLayout *channel_layout, if (ret < 0) return ret; - return bp.len; + if (bp.len >= INT_MAX) + return AVERROR(ERANGE); + return bp.len + 1; } enum AVChannel diff --git a/libavutil/version.h b/libavutil/version.h index b36310ee4c..5a4d4d3d73 100644 --- a/libavutil/version.h +++ b/libavutil/version.h @@ -80,7 +80,7 @@ #define LIBAVUTIL_VERSION_MAJOR 58 #define LIBAVUTIL_VERSION_MINOR 16 -#define LIBAVUTIL_VERSION_MICRO 100 +#define LIBAVUTIL_VERSION_MICRO 101 #define LIBAVUTIL_VERSION_INT AV_VERSION_INT(LIBAVUTIL_VERSION_MAJOR, \ LIBAVUTIL_VERSION_MINOR, \ |