diff options
| author | Anton Khirnov <anton@khirnov.net> | 2023-04-13 15:56:54 +0200 |
|---|---|---|
| committer | Anton Khirnov <anton@khirnov.net> | 2023-04-17 12:22:18 +0200 |
| commit | e30302c63638b0dfc5ba4bc60146c44d4af5ce40 (patch) | |
| tree | e274d0a37b10bbc380187eb5a815f15da59afebe | |
| parent | f6facaf8c9e33472fc0be8ba5cd9666f7b0ff32d (diff) | |
| download | ffmpeg-e30302c63638b0dfc5ba4bc60146c44d4af5ce40.tar.gz | |
fftools/ffmpeg: avoid possible invalid reads with short -tag values
Fixes #10319 and #10309.
Based on 89c9a3ac3542c3684e511607d88b265bfa6aa64f.
(cherry picked from commit 1e413487bf8ff413796d1cf1d9adafcd36f04444)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
| -rw-r--r-- | fftools/ffmpeg_opt.c | 14 |
1 files changed, 10 insertions, 4 deletions
diff --git a/fftools/ffmpeg_opt.c b/fftools/ffmpeg_opt.c index 9c820ab73f..8c27c0c6d8 100644 --- a/fftools/ffmpeg_opt.c +++ b/fftools/ffmpeg_opt.c @@ -819,8 +819,11 @@ static void add_input_streams(OptionsContext *o, AVFormatContext *ic) MATCH_PER_STREAM_OPT(codec_tags, str, codec_tag, ic, st); if (codec_tag) { uint32_t tag = strtol(codec_tag, &next, 0); - if (*next) - tag = AV_RL32(codec_tag); + if (*next) { + uint8_t buf[4] = { 0 }; + memcpy(buf, codec_tag, FFMIN(sizeof(buf), strlen(codec_tag))); + tag = AV_RL32(buf); + } st->codecpar->codec_tag = tag; } @@ -1572,8 +1575,11 @@ static OutputStream *new_output_stream(OptionsContext *o, AVFormatContext *oc, e MATCH_PER_STREAM_OPT(codec_tags, str, codec_tag, oc, st); if (codec_tag) { uint32_t tag = strtol(codec_tag, &next, 0); - if (*next) - tag = AV_RL32(codec_tag); + if (*next) { + uint8_t buf[4] = { 0 }; + memcpy(buf, codec_tag, FFMIN(sizeof(buf), strlen(codec_tag))); + tag = AV_RL32(buf); + } ost->st->codecpar->codec_tag = ost->enc_ctx->codec_tag = tag; } |