summaryrefslogtreecommitdiff
path: root/libavformat/webmdashenc.c
diff options
context:
space:
mode:
authorAndreas Rheinhardt <andreas.rheinhardt@gmail.com>2020-05-18 04:19:32 +0200
committerAndreas Rheinhardt <andreas.rheinhardt@gmail.com>2020-05-23 06:29:53 +0200
commit9b614826275e346ac17b9bc7ef5a58dded5b1855 (patch)
tree7f8c39569a257d6032cfd09fa1f84a503656e543 /libavformat/webmdashenc.c
parent1030993db212667d64cd0234c2ef1fccd30f0c1f (diff)
avformat/webmdashenc: Remove possibility of infinite loop
The WebM DASH manifest muxer uses a loop to parse the adaptation_sets string (which is given by the user and governs which AVStreams are mapped to what adaptation set) and the very beginning of this loop is "if (*p == ' ') continue;". This of course leads to an infinite loop if the condition is true. It is true if e.g. the string begins with ' ' or if there are more than one ' ' between different adaptation set groups. To fix this, the parsing process has been modified to consume the space if it is at a place where it can legitimately occur, i.e. when a new adaptation set group is expected. The latter restriction implies that an error is returned if a space exists where none is allowed to exist. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Diffstat (limited to 'libavformat/webmdashenc.c')
-rw-r--r--libavformat/webmdashenc.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/libavformat/webmdashenc.c b/libavformat/webmdashenc.c
index 250c8ca3ad..fd07b3e34a 100644
--- a/libavformat/webmdashenc.c
+++ b/libavformat/webmdashenc.c
@@ -438,9 +438,10 @@ static int parse_adaptation_sets(AVFormatContext *s)
// syntax id=0,streams=0,1,2 id=1,streams=3,4 and so on
state = new_set;
while (p < w->adaptation_sets + strlen(w->adaptation_sets)) {
- if (*p == ' ')
+ if (state == new_set && *p == ' ') {
+ p++;
continue;
- else if (state == new_set && !strncmp(p, "id=", 3)) {
+ } else if (state == new_set && !strncmp(p, "id=", 3)) {
void *mem = av_realloc(w->as, sizeof(*w->as) * (w->nb_as + 1));
const char *comma;
if (mem == NULL)