diff mbox series

[FFmpeg-devel,2/2] avformat/dashdec: Avoid segfault when URL template is unexpectedly missing

Message ID DB6PR0901MB1495322CB51680B79B7CBAC2ECBD0@DB6PR0901MB1495.eurprd09.prod.outlook.com
State Accepted
Headers show
Series [FFmpeg-devel,1/2] avformat/dashdec: Fix missing NULL check
Related show

Checks

Context Check Description
andriy/configure warning Failed to apply patch
andriy/configure warning Failed to apply patch

Commit Message

sfan5 Jan. 25, 2021, 3:25 p.m. UTC
This isn't supposed to happen, but unfinished support for non-templated
manifests and lack of e.g. presentationTimeOffset handling can provoke
such a situation even with well-formed input.
---
  libavformat/dashdec.c | 10 +++++++++-
  1 file changed, 9 insertions(+), 1 deletion(-)

          }
          ff_dash_fill_tmpl_params(tmpfilename, c->max_url_size, 
pls->url_template, 0, pls->cur_seq_no, 0, 
get_segment_start_time_based_on_timeline(pls, pls->cur_seq_no));
@@ -1637,6 +1644,7 @@ static struct fragment 
*get_current_fragment(struct representation *pls)
              if (!seg->url) {
                  av_log(pls->parent, AV_LOG_ERROR, "Cannot resolve 
template url '%s'\n", pls->url_template);
                  av_free(tmpfilename);
+                av_free(seg);
                  return NULL;
              }
          }

Comments

Steven Liu Jan. 26, 2021, 1:22 a.m. UTC | #1
sfan5 <sfan5@live.de> 于2021年1月25日周一 下午11:25写道:
>
> This isn't supposed to happen, but unfinished support for non-templated
> manifests and lack of e.g. presentationTimeOffset handling can provoke
> such a situation even with well-formed input.
> ---
>   libavformat/dashdec.c | 10 +++++++++-
>   1 file changed, 9 insertions(+), 1 deletion(-)
>
> diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c
> index dc56e89f11..c4e6c3da16 100644
> --- a/libavformat/dashdec.c
> +++ b/libavformat/dashdec.c
> @@ -1625,8 +1625,15 @@ static struct fragment
> *get_current_fragment(struct representation *pls)
>           }
>       }
>       if (seg) {
> -        char *tmpfilename= av_mallocz(c->max_url_size);
> +        char *tmpfilename;
> +        if (!pls->url_template) {
> +            av_log(pls->parent, AV_LOG_ERROR, "Cannot get fragment,
> missing template URL\n");
> +            av_free(seg);
> +            return NULL;
> +        }
> +        tmpfilename = av_mallocz(c->max_url_size);
>           if (!tmpfilename) {
> +            av_free(seg);
>               return NULL;
>           }
>           ff_dash_fill_tmpl_params(tmpfilename, c->max_url_size,
> pls->url_template, 0, pls->cur_seq_no, 0,
> get_segment_start_time_based_on_timeline(pls, pls->cur_seq_no));
> @@ -1637,6 +1644,7 @@ static struct fragment
> *get_current_fragment(struct representation *pls)
>               if (!seg->url) {
>                   av_log(pls->parent, AV_LOG_ERROR, "Cannot resolve
> template url '%s'\n", pls->url_template);
>                   av_free(tmpfilename);
> +                av_free(seg);
>                   return NULL;
>               }
>           }
> --
> 2.30.0
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

LGTM

Thanks
Steven
diff mbox series

Patch

diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c
index dc56e89f11..c4e6c3da16 100644
--- a/libavformat/dashdec.c
+++ b/libavformat/dashdec.c
@@ -1625,8 +1625,15 @@  static struct fragment 
*get_current_fragment(struct representation *pls)
          }
      }
      if (seg) {
-        char *tmpfilename= av_mallocz(c->max_url_size);
+        char *tmpfilename;
+        if (!pls->url_template) {
+            av_log(pls->parent, AV_LOG_ERROR, "Cannot get fragment, 
missing template URL\n");
+            av_free(seg);
+            return NULL;
+        }
+        tmpfilename = av_mallocz(c->max_url_size);
          if (!tmpfilename) {
+            av_free(seg);
              return NULL;