Stowage/ffmpeg
2
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-02-13 19:05:37 +00:00
Code Issues Projects Releases Packages Wiki Activity

avfilter/graphparser: Don't set pointer to one beyond '\0' of string

Browse source 
This happened in parse_link_name() if there was a '[' without matching
']'. While this is not undefined behaviour (pointer arithmetic one
beyond the end of an array works fine as long as there are no accesses),
it is potentially dangerous. It currently isn't (all callers of
parse_link_name() treat this as an error and don't access the string any
more), but making sure that this will never cause trouble in the future
seems nevertheless worthwhile.

Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit f33faa5b9b)
This commit is contained in:
Andreas Rheinhardt 2020-08-23 00:31:17 +02:00
parent 3b3d85c26e
commit b93ccb8d59
1 changed files with 4 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
libavfilter/graphparser.c
View file

@ -63,7 +63,7 @@ static char *parse_link_name(const char **buf, void *log_ctx)
name = av_get_token(buf, "]");
if (!name)
goto fail;
return NULL;
if (!name[0]) {
av_log(log_ctx, AV_LOG_ERROR,
@ -71,12 +71,14 @@ static char *parse_link_name(const char **buf, void *log_ctx)
goto fail;
}
if (*(*buf)++ != ']') {
if (**buf != ']') {
av_log(log_ctx, AV_LOG_ERROR,
"Mismatched '[' found in the following: \"%s\".\n", start);
fail:
av_freep(&name);
return NULL;
}
(*buf)++;
return name;
}