Message ID | 1588173257-14531-4-git-send-email-lance.lmwang@gmail.com |
---|---|
State | New |
Headers | show |
Series | [FFmpeg-devel,1/5] avformat/dashenc: fix invalid pointer access if avio_get_dyn_buf failed | expand |
Context | Check | Description |
---|---|---|
andriy/default | pending | |
andriy/make | success | Make finished |
andriy/make_fate | success | Make fate finished |
lance.lmwang@gmail.com (12020-04-29): > From: Limin Wang <lance.lmwang@gmail.com> > > Signed-off-by: Limin Wang <lance.lmwang@gmail.com> > --- > libavformat/movenc.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/libavformat/movenc.c b/libavformat/movenc.c > index 32e8109268..1a97e7c883 100644 > --- a/libavformat/movenc.c > +++ b/libavformat/movenc.c > @@ -5251,10 +5251,11 @@ static int mov_flush_fragment(AVFormatContext *s, int force) > return 0; > } > > - buf_size = avio_get_dyn_buf(mov->mdat_buf, &buf); > + if ((buf_size = avio_get_dyn_buf(mov->mdat_buf, &buf)) > 0) { > avio_wb32(s->pb, buf_size + 8); > ffio_wfourcc(s->pb, "mdat"); > avio_write(s->pb, buf, buf_size); > + } > ffio_free_dyn_buf(&mov->mdat_buf); > > if (mov->flags & FF_MOV_FLAG_GLOBAL_SIDX) This one seems broken like the other two. Regards,
diff --git a/libavformat/movenc.c b/libavformat/movenc.c index 32e8109268..1a97e7c883 100644 --- a/libavformat/movenc.c +++ b/libavformat/movenc.c @@ -5251,10 +5251,11 @@ static int mov_flush_fragment(AVFormatContext *s, int force) return 0; } - buf_size = avio_get_dyn_buf(mov->mdat_buf, &buf); + if ((buf_size = avio_get_dyn_buf(mov->mdat_buf, &buf)) > 0) { avio_wb32(s->pb, buf_size + 8); ffio_wfourcc(s->pb, "mdat"); avio_write(s->pb, buf, buf_size); + } ffio_free_dyn_buf(&mov->mdat_buf); if (mov->flags & FF_MOV_FLAG_GLOBAL_SIDX)