From 0a9a2257339c8697be31e64b36fa6208132b11bd Mon Sep 17 00:00:00 2001
From: Samuel Pitoiset <samuel.pitoiset@gmail.com>
Date: Mon, 11 Jun 2012 14:21:32 +0200
Subject: rtmp: Fix a possible access to invalid memory location when the
 playpath is too short.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Martin Storsjö <martin@martin.st>
---
 libavformat/rtmpproto.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavformat/rtmpproto.c b/libavformat/rtmpproto.c
index e9a3e4336e..56011f1cde 100644
--- a/libavformat/rtmpproto.c
+++ b/libavformat/rtmpproto.c
@@ -1141,11 +1141,11 @@ static int rtmp_open(URLContext *s, const char *uri, int flags)
             goto fail;
         }
 
-        if (!strchr(fname, ':') &&
+        if (!strchr(fname, ':') && len >= 4 &&
             (!strcmp(fname + len - 4, ".f4v") ||
              !strcmp(fname + len - 4, ".mp4"))) {
             memcpy(rt->playpath, "mp4:", 5);
-        } else if (!strcmp(fname + len - 4, ".flv")) {
+        } else if (len >= 4 && !strcmp(fname + len - 4, ".flv")) {
             fname[len - 4] = '\0';
         } else {
             rt->playpath[0] = 0;
-- 
cgit v1.2.3