[FFmpeg-devel,2/2] avformat/mpjpegdec: fix strict boundary search string

Submitted by Moritz Barsnick on May 23, 2019, 4:06 p.m.

Details

Message ID 42241cac359c49d836530756db5e57e1b96b9f24.1558627113.git.barsnick@gmx.net
State New
Headers show

Commit Message

Moritz Barsnick May 23, 2019, 4:06 p.m.
According to RFC1341, the multipart boundary indicated by the
Content-Type header must be prepended by CRLF + "--", and followed
by CRLF. In the case of strict MIME header boundary handling, the
"--" was forgotten to add.

Fixes trac #7921.

Signed-off-by: Moritz Barsnick <barsnick@gmx.net>
---
 libavformat/mpjpegdec.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--
2.20.1

Comments

Michael Niedermayer May 24, 2019, 9:58 a.m.
On Thu, May 23, 2019 at 06:06:43PM +0200, Moritz Barsnick wrote:
> According to RFC1341, the multipart boundary indicated by the
> Content-Type header must be prepended by CRLF + "--", and followed
> by CRLF. In the case of strict MIME header boundary handling, the
> "--" was forgotten to add.
> 
> Fixes trac #7921.
> 
> Signed-off-by: Moritz Barsnick <barsnick@gmx.net>
> ---
>  libavformat/mpjpegdec.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/libavformat/mpjpegdec.c b/libavformat/mpjpegdec.c
> index a23469c0ec..f145766e6e 100644
> --- a/libavformat/mpjpegdec.c
> +++ b/libavformat/mpjpegdec.c
> @@ -306,8 +306,8 @@ static int mpjpeg_read_packet(AVFormatContext *s, AVPacket *pkt)
>              boundary = mpjpeg_get_boundary(s->pb);
>          }
>          if (boundary != NULL) {
> -            mpjpeg->boundary = boundary;
> -            mpjpeg->searchstr = av_asprintf( "\r\n%s\r\n", boundary );
> +            mpjpeg->boundary = av_asprintf("--%s", boundary);

memleak

also a testcase would be good to have, idealy in fate

thx

[...]
Moritz Barsnick May 26, 2019, 8:41 p.m.
On Fri, May 24, 2019 at 11:58:51 +0200, Michael Niedermayer wrote:
> >          if (boundary != NULL) {
> > -            mpjpeg->boundary = boundary;
> > -            mpjpeg->searchstr = av_asprintf( "\r\n%s\r\n", boundary );
> > +            mpjpeg->boundary = av_asprintf("--%s", boundary);
>
> memleak

Thanks for noticing. I'll post a V2 - verified with valgrind.

> also a testcase would be good to have, idealy in fate

Will try.

Moritz

Patch hide | download patch | download mbox

diff --git a/libavformat/mpjpegdec.c b/libavformat/mpjpegdec.c
index a23469c0ec..f145766e6e 100644
--- a/libavformat/mpjpegdec.c
+++ b/libavformat/mpjpegdec.c
@@ -306,8 +306,8 @@  static int mpjpeg_read_packet(AVFormatContext *s, AVPacket *pkt)
             boundary = mpjpeg_get_boundary(s->pb);
         }
         if (boundary != NULL) {
-            mpjpeg->boundary = boundary;
-            mpjpeg->searchstr = av_asprintf( "\r\n%s\r\n", boundary );
+            mpjpeg->boundary = av_asprintf("--%s", boundary);
+            mpjpeg->searchstr = av_asprintf("\r\n--%s\r\n", boundary);
         } else {
             mpjpeg->boundary = av_strdup("--");
             mpjpeg->searchstr = av_strdup("\r\n--");