From 3ab6a923d1b2ef804fef67a75013705141e4e4bc Mon Sep 17 00:00:00 2001 From: Andreas Rheinhardt Date: Wed, 6 May 2020 08:16:06 +0200 Subject: avformat/hlsenc: Don't segfault on uncommon names The parsing process of the AVOpt-enabled string controlling the mapping of input streams to variant streams is roughly as follows: Space and tab separate variant stream group maps while the entries in each variant stream group map are separated by ','. The parsing process of each variant stream group proceeded as follows: At first the number of occurences of "a:", "v:" and "s:" in each variant stream group is calculated so that one can can allocate an array of streams with this number of entries. Then the string is split along ',' and each substring is parsed. If such a substring starts with "a:", "s:" or "v:" it is treated as stream specifier and (if there is a correct number after ':') a stream of the variant stream is mapped to one of the actual input streams. Nothing actually guarantees that the number of streams allocated initially equals the number of streams that are mapped to an actual input stream. These numbers can differ if e.g. the name, the sgroup, agroup or ccgroup of the variant stream contain "a:", "s:" or "v:". The problem hereby is that the rest of the code presumes these numbers to be equal and segfaults if it isn't (because the corresponding input stream is NULL). This commit fixes this by modifying the initial counting process to only count occurences of "a:", "s:" or "v:" that are at the beginning or that immediately follow a ','. Signed-off-by: Andreas Rheinhardt --- libavformat/hlsenc.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'libavformat') diff --git a/libavformat/hlsenc.c b/libavformat/hlsenc.c index a21171c6f9..1bc3cb210b 100644 --- a/libavformat/hlsenc.c +++ b/libavformat/hlsenc.c @@ -1944,10 +1944,13 @@ static int parse_variant_stream_mapstring(AVFormatContext *s) return AVERROR(EINVAL); q = varstr; - while (q < varstr + strlen(varstr)) { + while (1) { if (!av_strncasecmp(q, "a:", 2) || !av_strncasecmp(q, "v:", 2) || !av_strncasecmp(q, "s:", 2)) vs->nb_streams++; + q = strchr(q, ','); + if (!q) + break; q++; } vs->streams = av_mallocz(sizeof(AVStream *) * vs->nb_streams); -- cgit v1.2.3