diff options
| author | Andreas Rheinhardt <andreas.rheinhardt@gmail.com> | 2021-03-02 11:20:29 +0100 |
|---|---|---|
| committer | Andreas Rheinhardt <andreas.rheinhardt@gmail.com> | 2021-03-02 11:49:10 +0100 |
| commit | ec5663d0a796cb8acde8ad04ac4cc7e2be7d5173 (patch) | |
| tree | 57dd0ba3d3cd703d17cffcb76c3cc07d4a017bd5 | |
| parent | 988deae6da70e3c24d8e75d75e300e49981599b7 (diff) | |
| download | ffmpeg-ec5663d0a796cb8acde8ad04ac4cc7e2be7d5173.tar.gz | |
avformat/dashdec: Ensure strings are zero-terminated
strncpy only ensures that one does not write beyond the end of the
destination buffer; in case of truncation it does not zero-terminate
the destination buffer. This makes using it the way it is now in the
DASH demuxer dangerous. So use av_strlcpy instead.
Also don't write anything if there is no id: The buffer has already been
zeroed initially.
The DASH testset from the Universität Klagenfurt contains samples with
ids that are too long. E.g.
http://ftp.itec.aau.at/datasets/DASHDataset2014/TearsOfSteel/1sec/TearsOfSteel_1s_simple_2014_05_09.mpd
Reviewed-by: Steven Liu <lq@chinaffmpeg.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
| -rw-r--r-- | libavformat/dashdec.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c index b82805c9ce..3a12aefa68 100644 --- a/libavformat/dashdec.c +++ b/libavformat/dashdec.c @@ -1042,7 +1042,8 @@ static int parse_manifest_representation(AVFormatContext *s, const char *url, if (rep->fragment_duration > 0 && !rep->fragment_timescale) rep->fragment_timescale = 1; rep->bandwidth = rep_bandwidth_val ? atoi(rep_bandwidth_val) : 0; - strncpy(rep->id, rep_id_val ? rep_id_val : "", sizeof(rep->id)); + if (rep_id_val) + av_strlcpy(rep->id, rep_id_val, sizeof(rep->id)); rep->framerate = av_make_q(0, 0); if (type == AVMEDIA_TYPE_VIDEO) { char *rep_framerate_val = xmlGetProp(representation_node, "frameRate"); |