[FFmpeg-devel] [PATCH 3/7] avformat/sdp: Fix potential write beyond end of buffer

[Michael Niedermayer]

On Thu, Jul 09, 2020 at 12:35:38PM +0200, Andreas Rheinhardt wrote:
> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt at gmail.com>
> ---
>  libavformat/sdp.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/libavformat/sdp.c b/libavformat/sdp.c
> index 34e9839b67..2ce1a62262 100644
> --- a/libavformat/sdp.c
> +++ b/libavformat/sdp.c
> @@ -212,7 +212,7 @@ static char *extradata2psets(AVFormatContext *s, AVCodecParameters *par)
>          p += strlen(p);
>          r = r1;
>      }
> -    if (sps && sps_end - sps >= 4) {
> +    if (sps && sps_end - sps >= 4 && p - psets <= MAX_PSET_SIZE - strlen(profile_string) - 7) {

probably ok

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Those who would give up essential Liberty, to purchase a little
temporary Safety, deserve neither Liberty nor Safety -- Benjamin Franklin
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20200710/8e23253e/attachment.sig>