Message ID | 1511746253-22707-1-git-send-email-bianpan2016@163.com |
---|---|
State | New |
Headers | show |
On Mon, Nov 27, 2017 at 09:30:53AM +0800, Pan Bian wrote: > The function avformat_new_stream() returns a NULL pointer on failure. > However, in function rtp_mpegts_write_header(), its return value is not > validated before it is dereferenced. Check the return value against NULL > to avoid potential NULL dereference. > > Signed-off-by: Pan Bian <bianpan2016@163.com> > --- > libavformat/rtpenc_mpegts.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/libavformat/rtpenc_mpegts.c b/libavformat/rtpenc_mpegts.c > index 7af02e0..9089d61 100644 > --- a/libavformat/rtpenc_mpegts.c > +++ b/libavformat/rtpenc_mpegts.c > @@ -85,6 +85,10 @@ static int rtp_mpegts_write_header(AVFormatContext *s) > } > rtp_ctx->oformat = rtp_format; > st = avformat_new_stream(rtp_ctx, NULL); > + if (!st) { > + ret = AVERROR(ENOMEM); > + goto fail; > + } > st->time_base.num = 1; > st->time_base.den = 90000; > st->codecpar->codec_id = AV_CODEC_ID_MPEG2TS; will apply with the tabs removed thx [...]
diff --git a/libavformat/rtpenc_mpegts.c b/libavformat/rtpenc_mpegts.c index 7af02e0..9089d61 100644 --- a/libavformat/rtpenc_mpegts.c +++ b/libavformat/rtpenc_mpegts.c @@ -85,6 +85,10 @@ static int rtp_mpegts_write_header(AVFormatContext *s) } rtp_ctx->oformat = rtp_format; st = avformat_new_stream(rtp_ctx, NULL); + if (!st) { + ret = AVERROR(ENOMEM); + goto fail; + } st->time_base.num = 1; st->time_base.den = 90000; st->codecpar->codec_id = AV_CODEC_ID_MPEG2TS;
The function avformat_new_stream() returns a NULL pointer on failure. However, in function rtp_mpegts_write_header(), its return value is not validated before it is dereferenced. Check the return value against NULL to avoid potential NULL dereference. Signed-off-by: Pan Bian <bianpan2016@163.com> --- libavformat/rtpenc_mpegts.c | 4 ++++ 1 file changed, 4 insertions(+)