diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2019-02-13 10:15:04 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2019-03-21 10:42:52 +0100 |
| commit | f1263f5c7d656ddff75a1127aa45d346e35752fb (patch) | |
| tree | dd268a1771650defaaaf3090a84a4a0f569a4334 | |
| parent | 4a9f11129697a03353ae58ae42d1c3248de3d0aa (diff) | |
| download | ffmpeg-f1263f5c7d656ddff75a1127aa45d346e35752fb.tar.gz | |
avformat/webmdashenc: Check id in adaption_sets
Fixes: out of array access
Found-by: Wenxiang Qian
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b687b549aa0fb115861b1343208de8c2630803bf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/webmdashenc.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/libavformat/webmdashenc.c b/libavformat/webmdashenc.c index 1280d8a763..26b8727304 100644 --- a/libavformat/webmdashenc.c +++ b/libavformat/webmdashenc.c @@ -466,6 +466,7 @@ static int parse_adaptation_sets(AVFormatContext *s) continue; else if (state == new_set && !strncmp(p, "id=", 3)) { void *mem = av_realloc(w->as, sizeof(*w->as) * (w->nb_as + 1)); + const char *comma; if (mem == NULL) return AVERROR(ENOMEM); w->as = mem; @@ -474,6 +475,11 @@ static int parse_adaptation_sets(AVFormatContext *s) w->as[w->nb_as - 1].streams = NULL; p += 3; // consume "id=" q = w->as[w->nb_as - 1].id; + comma = strchr(p, ','); + if (!comma || comma - p >= sizeof(w->as[w->nb_as - 1].id)) { + av_log(s, AV_LOG_ERROR, "'id' in 'adaptation_sets' is malformed.\n"); + return AVERROR(EINVAL); + } while (*p != ',') *q++ = *p++; *q = 0; p++; |