diff options
author | Michael Niedermayer <michaelni@gmx.at> | 2013-11-27 17:04:05 +0100 |
---|---|---|
committer | Michael Niedermayer <michaelni@gmx.at> | 2013-11-27 17:06:42 +0100 |
commit | 808c10e728db2d92ccbb0f8b3bcd4a2f4305a2cf (patch) | |
tree | 4caa4c7dd12a17309089fb1db9cb7028036fc31d /libavutil | |
parent | 6b58488f926af1fa38ceb189e891c2d5925f4633 (diff) | |
download | ffmpeg-808c10e728db2d92ccbb0f8b3bcd4a2f4305a2cf.tar.gz |
avutil/log: check that len is within the buffer before reading it
Fixes out of array read
Fixes: asan_heap-oob_19d6979_6857_mmw_deadzy.ogg
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavutil')
-rw-r--r-- | libavutil/log.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavutil/log.c b/libavutil/log.c index 56ef53b378..5923228039 100644 --- a/libavutil/log.c +++ b/libavutil/log.c @@ -200,7 +200,7 @@ static void format_line(void *ptr, int level, const char *fmt, va_list vl, av_vbprintf(part+2, fmt, vl); if(*part[0].str || *part[1].str || *part[2].str) { - char lastc = part[2].len ? part[2].str[part[2].len - 1] : 0; + char lastc = part[2].len && part[2].len <= part[2].size ? part[2].str[part[2].len - 1] : 0; *print_prefix = lastc == '\n' || lastc == '\r'; } } |