From: Limin Wang <[email protected]> If an error occurs, avio_get_dyn_buf() will return 0 and buf is NULL, so it's necessary to check the return value for the following code will access the buf pointer with index. In addition, the buf len should be greater than written_len to avoid the buffer overflow access.
Signed-off-by: Limin Wang <[email protected]> --- libavformat/dashenc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/dashenc.c b/libavformat/dashenc.c index 9f83785792..99fb7d67af 100644 --- a/libavformat/dashenc.c +++ b/libavformat/dashenc.c @@ -2260,7 +2260,7 @@ static int dash_write_packet(AVFormatContext *s, AVPacket *pkt) uint8_t *buf = NULL; avio_flush(os->ctx->pb); len = avio_get_dyn_buf (os->ctx->pb, &buf); - if (os->out) { + if (os->out && len > os->written_len) { avio_write(os->out, buf + os->written_len, len - os->written_len); avio_flush(os->out); } -- 2.21.0 _______________________________________________ ffmpeg-devel mailing list [email protected] https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email [email protected] with subject "unsubscribe".
