| Message ID | 20210727150045.766-1-jamrial@gmail.com |
|---|---|
| State | Accepted |
| Commit | 487dfa9f04bb825669441476ffd683a7783d5ce9 |
| Headers | show |
| Series | [FFmpeg-devel] avformat/concat: check the terminating character returned by av_get_token() | expand |
| Context | Check | Description |
|---|---|---|
| andriy/x86_make | success | Make finished |
| andriy/x86_make_fate | success | Make fate finished |
| andriy/PPC64_make | success | Make finished |
| andriy/PPC64_make_fate | success | Make fate finished |
On 7/27/2021 12:04 PM, Nicolas George wrote: > James Almer (12021-07-27): >> Don't attempt to increase the cursor pointer if it was \0. >> Fixes invalid reads. >> >> Signed-off-by: James Almer <jamrial@gmail.com> >> --- >> libavformat/concat.c | 3 ++- >> 1 file changed, 2 insertions(+), 1 deletion(-) > > LGTM, but I do not maintain this file. > > Regards, Applied, thanks.
diff --git a/libavformat/concat.c b/libavformat/concat.c index aec1f52d8e..2560811ff9 100644 --- a/libavformat/concat.c +++ b/libavformat/concat.c @@ -251,7 +251,8 @@ static av_cold int concatf_open(URLContext *h, const char *uri, int flags) err = AVERROR(ENOMEM); break; } - cursor++; + if (*cursor) + cursor++; if (++len == SIZE_MAX / sizeof(*nodes)) { av_free(node_uri);
Don't attempt to increase the cursor pointer if it was \0. Fixes invalid reads. Signed-off-by: James Almer <jamrial@gmail.com> --- libavformat/concat.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)