diff mbox

[FFmpeg-devel] avfilter/af_pan: fix null pointer dereference on empty token

Message ID 20170205012720.16257-1-cus@passwd.hu
State Accepted
Headers show

Commit Message

Marton Balint Feb. 5, 2017, 1:27 a.m. UTC
Fixes Coverity CID 1396254.

Signed-off-by: Marton Balint <cus@passwd.hu>
---
 libavfilter/af_pan.c | 5 +++++
 1 file changed, 5 insertions(+)

Comments

Nicolas George Feb. 5, 2017, 9:23 a.m. UTC | #1
Le septidi 17 pluviôse, an CCXXV, Marton Balint a écrit :
> Fixes Coverity CID 1396254.
> 
> Signed-off-by: Marton Balint <cus@passwd.hu>
> ---
>  libavfilter/af_pan.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/libavfilter/af_pan.c b/libavfilter/af_pan.c
> index 94f1587..00eef2b 100644
> --- a/libavfilter/af_pan.c
> +++ b/libavfilter/af_pan.c
> @@ -115,6 +115,11 @@ static av_cold int init(AVFilterContext *ctx)
>      if (!args)
>          return AVERROR(ENOMEM);
>      arg = av_strtok(args, "|", &tokenizer);

> +    if (!arg) {
> +        av_log(ctx, AV_LOG_ERROR, "Cannot tokenize argument\n");
> +        ret = AVERROR(EINVAL);
> +        goto fail;
> +    }

Thanks for catching this. The fix seems correct. The error message, on
the other hand, is not good: it is meant for users but does not tell
them anything.

If I read the code correctly, this can only be triggered if the argument
to pan contains only the delimiter character. Something like "channel
layout not specified" would be more useful.

>      ret = ff_parse_channel_layout(&pan->out_channel_layout,
>                                    &pan->nb_output_channels, arg, ctx);
>      if (ret < 0)

Regards,
Marton Balint Feb. 5, 2017, 10:01 p.m. UTC | #2
On Sun, 5 Feb 2017, Nicolas George wrote:

> Le septidi 17 pluviôse, an CCXXV, Marton Balint a écrit :
>> Fixes Coverity CID 1396254.
>>
>> Signed-off-by: Marton Balint <cus@passwd.hu>
>> ---
>>  libavfilter/af_pan.c | 5 +++++
>>  1 file changed, 5 insertions(+)
>>
>> diff --git a/libavfilter/af_pan.c b/libavfilter/af_pan.c
>> index 94f1587..00eef2b 100644
>> --- a/libavfilter/af_pan.c
>> +++ b/libavfilter/af_pan.c
>> @@ -115,6 +115,11 @@ static av_cold int init(AVFilterContext *ctx)
>>      if (!args)
>>          return AVERROR(ENOMEM);
>>      arg = av_strtok(args, "|", &tokenizer);
>
>> +    if (!arg) {
>> +        av_log(ctx, AV_LOG_ERROR, "Cannot tokenize argument\n");
>> +        ret = AVERROR(EINVAL);
>> +        goto fail;
>> +    }
>
> Thanks for catching this. The fix seems correct. The error message, on
> the other hand, is not good: it is meant for users but does not tell
> them anything.
>
> If I read the code correctly, this can only be triggered if the argument
> to pan contains only the delimiter character. Something like "channel
> layout not specified" would be more useful.
>

Well, Coverity found it, I only fixed it :)

Pushed with the proposed error message.

Thanks,
Marton
diff mbox

Patch

diff --git a/libavfilter/af_pan.c b/libavfilter/af_pan.c
index 94f1587..00eef2b 100644
--- a/libavfilter/af_pan.c
+++ b/libavfilter/af_pan.c
@@ -115,6 +115,11 @@  static av_cold int init(AVFilterContext *ctx)
     if (!args)
         return AVERROR(ENOMEM);
     arg = av_strtok(args, "|", &tokenizer);
+    if (!arg) {
+        av_log(ctx, AV_LOG_ERROR, "Cannot tokenize argument\n");
+        ret = AVERROR(EINVAL);
+        goto fail;
+    }
     ret = ff_parse_channel_layout(&pan->out_channel_layout,
                                   &pan->nb_output_channels, arg, ctx);
     if (ret < 0)