[FFmpeg-cvslog] avfilter/af_compand: Check av_strtok() for failure

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Thu Apr 20 02:19:21 2017 +0200| [88612f8db3b8b0c6e51f9136ec4915f72cbc9a56] | committer: Michael Niedermayer

avfilter/af_compand: Check av_strtok() for failure

Fixes CID1396256

Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=88612f8db3b8b0c6e51f9136ec4915f72cbc9a56
---

 libavfilter/af_compand.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/libavfilter/af_compand.c b/libavfilter/af_compand.c
index 0bb719fae5..2acaa99ea2 100644
--- a/libavfilter/af_compand.c
+++ b/libavfilter/af_compand.c
@@ -368,6 +368,10 @@ static int config_output(AVFilterLink *outlink)
     p = s->attacks;
     for (i = 0, new_nb_items = 0; i < nb_attacks; i++) {
         char *tstr = av_strtok(p, " |", &saveptr);
+        if (!tstr) {
+            uninit(ctx);
+            return AVERROR(EINVAL);
+        }
         p = NULL;
         new_nb_items += sscanf(tstr, "%lf", &s->channels[i].attack) == 1;
         if (s->channels[i].attack < 0) {
@@ -380,6 +384,10 @@ static int config_output(AVFilterLink *outlink)
     p = s->decays;
     for (i = 0, new_nb_items = 0; i < nb_decays; i++) {
         char *tstr = av_strtok(p, " |", &saveptr);
+        if (!tstr) {
+            uninit(ctx);
+            return AVERROR(EINVAL);
+        }
         p = NULL;
         new_nb_items += sscanf(tstr, "%lf", &s->channels[i].decay) == 1;
         if (s->channels[i].decay < 0) {
@@ -407,7 +415,7 @@ static int config_output(AVFilterLink *outlink)
     for (i = 0, new_nb_items = 0; i < nb_points; i++) {
         char *tstr = av_strtok(p, " |", &saveptr);
         p = NULL;
-        if (sscanf(tstr, "%lf/%lf", &S(i).x, &S(i).y) != 2) {
+        if (!tstr || sscanf(tstr, "%lf/%lf", &S(i).x, &S(i).y) != 2) {
             av_log(ctx, AV_LOG_ERROR,
                     "Invalid and/or missing input/output value.\n");
             uninit(ctx);