On Wed, 28 Oct 2020, Michael Niedermayer wrote:
Fixes: out array read
Fixes:
26610/clusterfuzz-testcase-minimized-ffmpeg_dem_CONCAT_fuzzer-5631838049271808
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
---
libavformat/concatdec.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/libavformat/concatdec.c b/libavformat/concatdec.c
index 4b56b61404..0734bc44e1 100644
--- a/libavformat/concatdec.c
+++ b/libavformat/concatdec.c
@@ -123,7 +123,8 @@ static int add_file(AVFormatContext *avf, char *filename,
ConcatFile **rfile,
proto = avio_find_protocol_name(filename);
proto_len = proto ? strlen(proto) : 0;
- if (proto && !memcmp(filename, proto, proto_len) &&
+ if (proto && strlen(filename) >= proto_len &&
+ !memcmp(filename, proto, proto_len) &&
Why not strncmp?
Thanks,
Marton
(filename[proto_len] == ':' || filename[proto_len] == ',')) {
url = filename;
filename = NULL;
--
2.17.1
_______________________________________________
ffmpeg-devel mailing list
[email protected]
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
[email protected] with subject "unsubscribe".
_______________________________________________
ffmpeg-devel mailing list
[email protected]
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
[email protected] with subject "unsubscribe".
