diff mbox

[FFmpeg-devel,V3,2/2] avformat/dashdec: fix segfault when parsing segmentlist

Message ID 20190916104428.23631-2-hello.vectronic@gmail.com
State New
Headers show

Commit Message

vectronic Sept. 16, 2019, 10:44 a.m. UTC
index into segmentlists_tab was specified as 4 instead of 3 causing invalid access

further fix to: 8135

Signed-off-by: vectronic <hello.vectronic@gmail.com>
---
 libavformat/dashdec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

vectronic Sept. 23, 2019, 9:19 a.m. UTC | #1
> On 16 Sep 2019, at 11:44, vectronic <hello.vectronic@gmail.com> wrote:
> 
> index into segmentlists_tab was specified as 4 instead of 3 causing invalid access
> 
> further fix to: 8135
> 
> Signed-off-by: vectronic <hello.vectronic@gmail.com>
> ---
> libavformat/dashdec.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c
> index 738bfeaefb..7713ee8907 100644
> --- a/libavformat/dashdec.c
> +++ b/libavformat/dashdec.c
> @@ -1017,7 +1017,7 @@ static int parse_manifest_representation(AVFormatContext *s, const char *url,
> 
>             duration_val = get_val_from_nodes_tab(segmentlists_tab, 3, "duration");
>             timescale_val = get_val_from_nodes_tab(segmentlists_tab, 3, "timescale");
> -            startnumber_val = get_val_from_nodes_tab(segmentlists_tab, 4, "startNumber");
> +            startnumber_val = get_val_from_nodes_tab(segmentlists_tab, 3, "startNumber");
>             if (duration_val) {
>                 rep->fragment_duration = (int64_t) strtoll(duration_val, NULL, 10);
>                 av_log(s, AV_LOG_TRACE, "rep->fragment_duration = [%"PRId64"]\n", rep->fragment_duration);
> -- 
> 2.20.1 (Apple Git-117)
> 


Could this be applied? It looks like it was introduced as a copy/paste error.


Thanks.
diff mbox

Patch

diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c
index 738bfeaefb..7713ee8907 100644
--- a/libavformat/dashdec.c
+++ b/libavformat/dashdec.c
@@ -1017,7 +1017,7 @@  static int parse_manifest_representation(AVFormatContext *s, const char *url,
 
             duration_val = get_val_from_nodes_tab(segmentlists_tab, 3, "duration");
             timescale_val = get_val_from_nodes_tab(segmentlists_tab, 3, "timescale");
-            startnumber_val = get_val_from_nodes_tab(segmentlists_tab, 4, "startNumber");
+            startnumber_val = get_val_from_nodes_tab(segmentlists_tab, 3, "startNumber");
             if (duration_val) {
                 rep->fragment_duration = (int64_t) strtoll(duration_val, NULL, 10);
                 av_log(s, AV_LOG_TRACE, "rep->fragment_duration = [%"PRId64"]\n", rep->fragment_duration);