diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2025-07-28 23:41:56 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2025-08-03 00:31:12 +0200 |
| commit | ce0a655f85c1144d19a4acad59afbb92e4997e30 (patch) | |
| tree | 291a004a5603fd4275f4a6878f4f6b487f2eb385 | |
| parent | ff52147f5929796baf7bf6ddd968f2d61b5f037d (diff) | |
| download | ffmpeg-ce0a655f85c1144d19a4acad59afbb92e4997e30.tar.gz | |
avformat/dashdec: Allocate space for appended "/"
Fixes: writing 1 byte over the end of the array
Fixes: BIGSLEEP-433502298/test.xml
Found-by: Google Big Sleep
A prettier solution is welcome!
A testcase exists only for the baseurl case
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/dashdec.c | 13 |
1 files changed, 11 insertions, 2 deletions
diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c index c3f3d7f3f8..278c70315d 100644 --- a/libavformat/dashdec.c +++ b/libavformat/dashdec.c @@ -735,7 +735,7 @@ static int resolve_content_path(AVFormatContext *s, const char *url, int *max_ur } tmp_max_url_size = aligned(tmp_max_url_size); - text = av_mallocz(tmp_max_url_size); + text = av_mallocz(tmp_max_url_size + 1); if (!text) { updated = AVERROR(ENOMEM); goto end; @@ -747,7 +747,7 @@ static int resolve_content_path(AVFormatContext *s, const char *url, int *max_ur } av_free(text); - path = av_mallocz(tmp_max_url_size); + path = av_mallocz(tmp_max_url_size + 2); tmp_str = av_mallocz(tmp_max_url_size); if (!tmp_str || !path) { updated = AVERROR(ENOMEM); @@ -769,6 +769,15 @@ static int resolve_content_path(AVFormatContext *s, const char *url, int *max_ur node = baseurl_nodes[rootId]; baseurl = xmlNodeGetContent(node); + if (baseurl) { + size_t len = xmlStrlen(baseurl)+2; + char *tmp = xmlRealloc(baseurl, len); + if (!tmp) { + updated = AVERROR(ENOMEM); + goto end; + } + baseurl = tmp; + } root_url = (av_strcasecmp(baseurl, "")) ? baseurl : path; if (node) { xmlNodeSetContent(node, root_url); |