diff mbox

[FFmpeg-devel] avformat/dashdec: fix segfault when parsing segmentlist

Message ID 20190913163607.91841-1-hello.vectronic@gmail.com
State Accepted
Commit 8c90bb8ebb6e60d1e6f48259091c0f3f7ff57b3e
Headers show

Commit Message

vectronic Sept. 13, 2019, 4:36 p.m. UTC
index into segmentlists_tab was specified as 4 instead of 3 causing invalid access

further fix to: 7976

Signed-off-by: vectronic <hello.vectronic@gmail.com>
---
 libavformat/dashdec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Carl Eugen Hoyos Sept. 13, 2019, 5:09 p.m. UTC | #1
Am Fr., 13. Sept. 2019 um 18:36 Uhr schrieb vectronic
<hello.vectronic@gmail.com>:
>
> index into segmentlists_tab was specified as 4 instead of 3 causing invalid access
>
> further fix to: 7976

This looks unrelated to the backtrace provided in ticket #7976.

> Signed-off-by: vectronic <hello.vectronic@gmail.com>
> ---
>  libavformat/dashdec.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c
> index 4f725ba09a..6a44912248 100644
> --- a/libavformat/dashdec.c
> +++ b/libavformat/dashdec.c
> @@ -1017,7 +1017,7 @@ static int parse_manifest_representation(AVFormatContext *s, const char *url,
>
>              duration_val = get_val_from_nodes_tab(segmentlists_tab, 3, "duration");
>              timescale_val = get_val_from_nodes_tab(segmentlists_tab, 3, "timescale");
> -            startnumber_val = get_val_from_nodes_tab(segmentlists_tab, 4, "startNumber");
> +            startnumber_val = get_val_from_nodes_tab(segmentlists_tab, 3, "startNumber");
>              if (duration_val) {
>                  rep->fragment_duration = (int64_t) strtoll(duration_val, NULL, 10);
>                  av_log(s, AV_LOG_TRACE, "rep->fragment_duration = [%"PRId64"]\n", rep->fragment_duration);

Carl Eugen
diff mbox

Patch

diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c
index 4f725ba09a..6a44912248 100644
--- a/libavformat/dashdec.c
+++ b/libavformat/dashdec.c
@@ -1017,7 +1017,7 @@  static int parse_manifest_representation(AVFormatContext *s, const char *url,
 
             duration_val = get_val_from_nodes_tab(segmentlists_tab, 3, "duration");
             timescale_val = get_val_from_nodes_tab(segmentlists_tab, 3, "timescale");
-            startnumber_val = get_val_from_nodes_tab(segmentlists_tab, 4, "startNumber");
+            startnumber_val = get_val_from_nodes_tab(segmentlists_tab, 3, "startNumber");
             if (duration_val) {
                 rep->fragment_duration = (int64_t) strtoll(duration_val, NULL, 10);
                 av_log(s, AV_LOG_TRACE, "rep->fragment_duration = [%"PRId64"]\n", rep->fragment_duration);