From 8dde01b57b3cb10ae3efc73badff4476572e8bba Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 13 Feb 2019 10:15:04 +0100 Subject: [PATCH] avformat/webmdashenc: Check id in adaption_sets Fixes: out of array access Found-by: Wenxiang Qian Signed-off-by: Michael Niedermayer (cherry picked from commit b687b549aa0fb115861b1343208de8c2630803bf) Signed-off-by: Michael Niedermayer --- libavformat/webmdashenc.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libavformat/webmdashenc.c b/libavformat/webmdashenc.c index 7c7156b35f..9832e68a94 100644 --- a/libavformat/webmdashenc.c +++ b/libavformat/webmdashenc.c @@ -439,6 +439,7 @@ static int parse_adaptation_sets(AVFormatContext *s) continue; else if (state == new_set && !strncmp(p, "id=", 3)) { void *mem = av_realloc(w->as, sizeof(*w->as) * (w->nb_as + 1)); + const char *comma; if (mem == NULL) return AVERROR(ENOMEM); w->as = mem; @@ -447,6 +448,11 @@ static int parse_adaptation_sets(AVFormatContext *s) w->as[w->nb_as - 1].streams = NULL; p += 3; // consume "id=" q = w->as[w->nb_as - 1].id; + comma = strchr(p, ','); + if (!comma || comma - p >= sizeof(w->as[w->nb_as - 1].id)) { + av_log(s, AV_LOG_ERROR, "'id' in 'adaptation_sets' is malformed.\n"); + return AVERROR(EINVAL); + } while (*p != ',') *q++ = *p++; *q = 0; p++;