diff mbox series

[FFmpeg-devel,4/5] avformat/movenc: check the return value of avio_get_dyn_buf()

Message ID 1588173257-14531-4-git-send-email-lance.lmwang@gmail.com
State New
Headers show
Series [FFmpeg-devel,1/5] avformat/dashenc: fix invalid pointer access if avio_get_dyn_buf failed | expand

Checks

Context Check Description
andriy/default pending
andriy/make success Make finished
andriy/make_fate success Make fate finished

Commit Message

Lance Wang April 29, 2020, 3:14 p.m. UTC 
From: Limin Wang <lance.lmwang@gmail.com>

Signed-off-by: Limin Wang <lance.lmwang@gmail.com>
---
 libavformat/movenc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Comments

Nicolas George April 29, 2020, 3:19 p.m. UTC | #1 
lance.lmwang@gmail.com (12020-04-29):
> From: Limin Wang <lance.lmwang@gmail.com>
> 
> Signed-off-by: Limin Wang <lance.lmwang@gmail.com>
> ---
>  libavformat/movenc.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/libavformat/movenc.c b/libavformat/movenc.c
> index 32e8109268..1a97e7c883 100644
> --- a/libavformat/movenc.c
> +++ b/libavformat/movenc.c
> @@ -5251,10 +5251,11 @@ static int mov_flush_fragment(AVFormatContext *s, int force)
>              return 0;
>          }
>  
> -        buf_size = avio_get_dyn_buf(mov->mdat_buf, &buf);
> +        if ((buf_size = avio_get_dyn_buf(mov->mdat_buf, &buf)) > 0) {
>          avio_wb32(s->pb, buf_size + 8);
>          ffio_wfourcc(s->pb, "mdat");
>          avio_write(s->pb, buf, buf_size);
> +        }
>          ffio_free_dyn_buf(&mov->mdat_buf);
>  
>          if (mov->flags & FF_MOV_FLAG_GLOBAL_SIDX)

This one seems broken like the other two.

Regards,
diff mbox series

Patch

diff --git a/libavformat/movenc.c b/libavformat/movenc.c
index 32e8109268..1a97e7c883 100644
--- a/libavformat/movenc.c
+++ b/libavformat/movenc.c
@@ -5251,10 +5251,11 @@  static int mov_flush_fragment(AVFormatContext *s, int force)
             return 0;
         }
 
-        buf_size = avio_get_dyn_buf(mov->mdat_buf, &buf);
+        if ((buf_size = avio_get_dyn_buf(mov->mdat_buf, &buf)) > 0) {
         avio_wb32(s->pb, buf_size + 8);
         ffio_wfourcc(s->pb, "mdat");
         avio_write(s->pb, buf, buf_size);
+        }
         ffio_free_dyn_buf(&mov->mdat_buf);
 
         if (mov->flags & FF_MOV_FLAG_GLOBAL_SIDX)