diff mbox series

[FFmpeg-devel,2/8] avcodec/samidec: do not overread if zero padding is missing

Message ID 20210313213345.3268-2-cus@passwd.hu
State New
Headers show
Series [FFmpeg-devel,1/8] avcodec/assdec: do not overread if zero padding is missing | expand

Checks

Context Check Description
andriy/x86_make success Make finished
andriy/x86_make_fate success Make fate finished
andriy/PPC64_make success Make finished
andriy/PPC64_make_fate success Make fate finished

Commit Message

Marton Balint March 13, 2021, 9:33 p.m. UTC 
Signed-off-by: Marton Balint <cus@passwd.hu>
---
 libavcodec/samidec.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)
diff mbox series

Patch

diff --git a/libavcodec/samidec.c b/libavcodec/samidec.c
index e32f238c62..f03b5db958 100644
--- a/libavcodec/samidec.c
+++ b/libavcodec/samidec.c
@@ -38,12 +38,12 @@  typedef struct {
     int readorder;
 } SAMIContext;
 
-static int sami_paragraph_to_ass(AVCodecContext *avctx, const char *src)
+static int sami_paragraph_to_ass(AVCodecContext *avctx, const char *src, size_t size)
 {
     SAMIContext *sami = avctx->priv_data;
     int ret = 0;
     char *tag = NULL;
-    char *dupsrc = av_strdup(src);
+    char *dupsrc = av_strndup(src, size);
     char *p = dupsrc;
     AVBPrint *dst_content = &sami->encoded_content;
     AVBPrint *dst_source = &sami->encoded_source;
@@ -135,11 +135,10 @@  static int sami_decode_frame(AVCodecContext *avctx,
                              void *data, int *got_sub_ptr, AVPacket *avpkt)
 {
     AVSubtitle *sub = data;
-    const char *ptr = avpkt->data;
     SAMIContext *sami = avctx->priv_data;
 
-    if (ptr && avpkt->size > 0) {
-        int ret = sami_paragraph_to_ass(avctx, ptr);
+    if (avpkt->data && avpkt->size > 0) {
+        int ret = sami_paragraph_to_ass(avctx, avpkt->data, avpkt->size);
         if (ret < 0)
             return ret;
         // TODO: pass escaped sami->encoded_source.str as source