aboutsummaryrefslogtreecommitdiffstats
path: root/libavformat/webmdashenc.c
diff options
context:
space:
mode:
authorMichael Niedermayer <michael@niedermayer.cc>2019-02-13 10:15:04 +0100
committerMichael Niedermayer <michael@niedermayer.cc>2019-02-17 10:29:42 +0100
commitb687b549aa0fb115861b1343208de8c2630803bf (patch)
tree313d67c4ccafee2980ad16d3838573a6919c69f5 /libavformat/webmdashenc.c
parent85f91ed760a517c0d5fcf692d40a5a9d7efa9476 (diff)
downloadffmpeg-b687b549aa0fb115861b1343208de8c2630803bf.tar.gz
avformat/webmdashenc: Check id in adaption_sets
Fixes: out of array access Found-by: Wenxiang Qian Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavformat/webmdashenc.c')
-rw-r--r--libavformat/webmdashenc.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/libavformat/webmdashenc.c b/libavformat/webmdashenc.c
index 1280d8a763..26b8727304 100644
--- a/libavformat/webmdashenc.c
+++ b/libavformat/webmdashenc.c
@@ -466,6 +466,7 @@ static int parse_adaptation_sets(AVFormatContext *s)
continue;
else if (state == new_set && !strncmp(p, "id=", 3)) {
void *mem = av_realloc(w->as, sizeof(*w->as) * (w->nb_as + 1));
+ const char *comma;
if (mem == NULL)
return AVERROR(ENOMEM);
w->as = mem;
@@ -474,6 +475,11 @@ static int parse_adaptation_sets(AVFormatContext *s)
w->as[w->nb_as - 1].streams = NULL;
p += 3; // consume "id="
q = w->as[w->nb_as - 1].id;
+ comma = strchr(p, ',');
+ if (!comma || comma - p >= sizeof(w->as[w->nb_as - 1].id)) {
+ av_log(s, AV_LOG_ERROR, "'id' in 'adaptation_sets' is malformed.\n");
+ return AVERROR(EINVAL);
+ }
while (*p != ',') *q++ = *p++;
*q = 0;
p++;