diff mbox

[FFmpeg-devel] avformat/dashdec: Fix strlen(rep_id_val) with it being NULL

Message ID 20180818011429.30074-1-michael@niedermayer.cc
State Accepted
Commit 46753bfdd0182f721499939a1118c0406c8a3674
Headers show

Commit Message

Michael Niedermayer Aug. 18, 2018, 1:14 a.m. UTC
Fixes: dash-crash-da39a3ee5e6b4b0d3255bfef95601890afd80709.xml

Found-by: Paul Ch <paulcher@icloud.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/dashdec.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

Comments

Liu Steven Aug. 18, 2018, 1:19 a.m. UTC | #1
> On Aug 18, 2018, at 09:14, Michael Niedermayer <michael@niedermayer.cc> wrote:
> 
> Fixes: dash-crash-da39a3ee5e6b4b0d3255bfef95601890afd80709.xml
> 
> Found-by: Paul Ch <paulcher@icloud.com>
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
> libavformat/dashdec.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c
> index f851bbf981..c6dddeb98f 100644
> --- a/libavformat/dashdec.c
> +++ b/libavformat/dashdec.c
> @@ -857,7 +857,9 @@ static int parse_manifest_representation(AVFormatContext *s, const char *url,
>         baseurl_nodes[3] = representation_baseurl_node;
> 
>         ret = resolve_content_path(s, url, &c->max_url_size, baseurl_nodes, 4);
> -        c->max_url_size = aligned(c->max_url_size  + strlen(rep_id_val) + strlen(rep_bandwidth_val));
> +        c->max_url_size = aligned(c->max_url_size
> +                                  + (rep_id_val ? strlen(rep_id_val) : 0)
> +                                  + (rep_bandwidth_val ? strlen(rep_bandwidth_val) : 0));
>         if (ret == AVERROR(ENOMEM) || ret == 0) {
>             goto end;
>         }
> -- 
> 2.18.0
> 
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> http://ffmpeg.org/mailman/listinfo/ffmpeg-devel

LGTM

Thanks
Steven
Michael Niedermayer Aug. 18, 2018, 8:03 p.m. UTC | #2
On Sat, Aug 18, 2018 at 09:19:10AM +0800, Steven Liu wrote:
> 
> 
> > On Aug 18, 2018, at 09:14, Michael Niedermayer <michael@niedermayer.cc> wrote:
> > 
> > Fixes: dash-crash-da39a3ee5e6b4b0d3255bfef95601890afd80709.xml
> > 
> > Found-by: Paul Ch <paulcher@icloud.com>
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> > libavformat/dashdec.c | 4 +++-
> > 1 file changed, 3 insertions(+), 1 deletion(-)
> > 
> > diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c
> > index f851bbf981..c6dddeb98f 100644
> > --- a/libavformat/dashdec.c
> > +++ b/libavformat/dashdec.c
> > @@ -857,7 +857,9 @@ static int parse_manifest_representation(AVFormatContext *s, const char *url,
> >         baseurl_nodes[3] = representation_baseurl_node;
> > 
> >         ret = resolve_content_path(s, url, &c->max_url_size, baseurl_nodes, 4);
> > -        c->max_url_size = aligned(c->max_url_size  + strlen(rep_id_val) + strlen(rep_bandwidth_val));
> > +        c->max_url_size = aligned(c->max_url_size
> > +                                  + (rep_id_val ? strlen(rep_id_val) : 0)
> > +                                  + (rep_bandwidth_val ? strlen(rep_bandwidth_val) : 0));
> >         if (ret == AVERROR(ENOMEM) || ret == 0) {
> >             goto end;
> >         }
> > -- 
> > 2.18.0
> > 
> > _______________________________________________
> > ffmpeg-devel mailing list
> > ffmpeg-devel@ffmpeg.org
> > http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
> 
> LGTM

will apply

thx

[...]
diff mbox

Patch

diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c
index f851bbf981..c6dddeb98f 100644
--- a/libavformat/dashdec.c
+++ b/libavformat/dashdec.c
@@ -857,7 +857,9 @@  static int parse_manifest_representation(AVFormatContext *s, const char *url,
         baseurl_nodes[3] = representation_baseurl_node;
 
         ret = resolve_content_path(s, url, &c->max_url_size, baseurl_nodes, 4);
-        c->max_url_size = aligned(c->max_url_size  + strlen(rep_id_val) + strlen(rep_bandwidth_val));
+        c->max_url_size = aligned(c->max_url_size
+                                  + (rep_id_val ? strlen(rep_id_val) : 0)
+                                  + (rep_bandwidth_val ? strlen(rep_bandwidth_val) : 0));
         if (ret == AVERROR(ENOMEM) || ret == 0) {
             goto end;
         }