diff mbox

[FFmpeg-devel] avformat/hlsenc: fix Explicit null dereferenced in hlsenc

Message ID 20170105002856.14251-1-lq@chinaffmpeg.org
State Accepted
Headers show

Commit Message

Liu Steven Jan. 5, 2017, 12:28 a.m. UTC
CID: 1398228
Passing null pointer dirname to strlen, which dereferences it.

Signed-off-by: Steven Liu <lq@chinaffmpeg.org>
---
 libavformat/hlsenc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Comments

Michael Niedermayer Jan. 5, 2017, 5:53 p.m. UTC | #1
On Thu, Jan 05, 2017 at 08:28:56AM +0800, Steven Liu wrote:
> CID: 1398228
> Passing null pointer dirname to strlen, which dereferences it.
> 
> Signed-off-by: Steven Liu <lq@chinaffmpeg.org>
> ---
>  libavformat/hlsenc.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/libavformat/hlsenc.c b/libavformat/hlsenc.c
> index 808a797..3c6490a 100644
> --- a/libavformat/hlsenc.c
> +++ b/libavformat/hlsenc.c
> @@ -285,8 +285,8 @@ static int hls_delete_old_segments(HLSContext *hls) {
>                                       path, strerror(errno));
>          }
>  
> -        if (segment->sub_filename[0] != '\0') {
> -            sub_path_size = strlen(dirname) + strlen(segment->sub_filename) + 1;
> +        if ((segment->sub_filename[0] != '\0')) {

> +            sub_path_size = (!dirname) ? (strlen(segment->sub_filename) + 1) : (strlen(dirname) + strlen(segment->sub_filename) + 1);

simpler:
sub_path_size = strlen(segment->sub_filename) + 1 + (dirname ? strlen(dirname) : 0);


[...]
diff mbox

Patch

diff --git a/libavformat/hlsenc.c b/libavformat/hlsenc.c
index 808a797..3c6490a 100644
--- a/libavformat/hlsenc.c
+++ b/libavformat/hlsenc.c
@@ -285,8 +285,8 @@  static int hls_delete_old_segments(HLSContext *hls) {
                                      path, strerror(errno));
         }
 
-        if (segment->sub_filename[0] != '\0') {
-            sub_path_size = strlen(dirname) + strlen(segment->sub_filename) + 1;
+        if ((segment->sub_filename[0] != '\0')) {
+            sub_path_size = (!dirname) ? (strlen(segment->sub_filename) + 1) : (strlen(dirname) + strlen(segment->sub_filename) + 1);
             sub_path = av_malloc(sub_path_size);
             if (!sub_path) {
                 ret = AVERROR(ENOMEM);