[FFmpeg-cvslog] fftools/ffmpeg: avoid possible invalid reads with short -tag values

[Anton Khirnov]

ffmpeg | branch: release/5.0 | Anton Khirnov <anton at khirnov.net> | Thu Apr 13 15:56:54 2023 +0200| [e30302c63638b0dfc5ba4bc60146c44d4af5ce40] | committer: Anton Khirnov

fftools/ffmpeg: avoid possible invalid reads with short -tag values

Fixes #10319 and #10309.

Based on 89c9a3ac3542c3684e511607d88b265bfa6aa64f.

(cherry picked from commit 1e413487bf8ff413796d1cf1d9adafcd36f04444)
Signed-off-by: Anton Khirnov <anton at khirnov.net>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=e30302c63638b0dfc5ba4bc60146c44d4af5ce40
---

 fftools/ffmpeg_opt.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/fftools/ffmpeg_opt.c b/fftools/ffmpeg_opt.c
index 9c820ab73f..8c27c0c6d8 100644
--- a/fftools/ffmpeg_opt.c
+++ b/fftools/ffmpeg_opt.c
@@ -819,8 +819,11 @@ static void add_input_streams(OptionsContext *o, AVFormatContext *ic)
         MATCH_PER_STREAM_OPT(codec_tags, str, codec_tag, ic, st);
         if (codec_tag) {
             uint32_t tag = strtol(codec_tag, &next, 0);
-            if (*next)
-                tag = AV_RL32(codec_tag);
+            if (*next) {
+                uint8_t buf[4] = { 0 };
+                memcpy(buf, codec_tag, FFMIN(sizeof(buf), strlen(codec_tag)));
+                tag = AV_RL32(buf);
+            }
             st->codecpar->codec_tag = tag;
         }
 
@@ -1572,8 +1575,11 @@ static OutputStream *new_output_stream(OptionsContext *o, AVFormatContext *oc, e
     MATCH_PER_STREAM_OPT(codec_tags, str, codec_tag, oc, st);
     if (codec_tag) {
         uint32_t tag = strtol(codec_tag, &next, 0);
-        if (*next)
-            tag = AV_RL32(codec_tag);
+        if (*next) {
+            uint8_t buf[4] = { 0 };
+            memcpy(buf, codec_tag, FFMIN(sizeof(buf), strlen(codec_tag)));
+            tag = AV_RL32(buf);
+        }
         ost->st->codecpar->codec_tag =
         ost->enc_ctx->codec_tag = tag;
     }