[FFmpeg-devel] [PATCH 2/4] avformat/concatdec: Check filename length before use

[Marton Balint]

On Wed, 28 Oct 2020, Michael Niedermayer wrote:

> Fixes: out array read
> Fixes: 26610/clusterfuzz-testcase-minimized-ffmpeg_dem_CONCAT_fuzzer-5631838049271808
>
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
> libavformat/concatdec.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/libavformat/concatdec.c b/libavformat/concatdec.c
> index 4b56b61404..0734bc44e1 100644
> --- a/libavformat/concatdec.c
> +++ b/libavformat/concatdec.c
> @@ -123,7 +123,8 @@ static int add_file(AVFormatContext *avf, char *filename, ConcatFile **rfile,
>
>     proto = avio_find_protocol_name(filename);
>     proto_len = proto ? strlen(proto) : 0;
> -    if (proto && !memcmp(filename, proto, proto_len) &&
> +    if (proto && strlen(filename) >= proto_len &&
> +        !memcmp(filename, proto, proto_len) &&

Why not strncmp?

Thanks,
Marton

>         (filename[proto_len] == ':' || filename[proto_len] == ',')) {
>         url = filename;
>         filename = NULL;
> -- 
> 2.17.1
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel at ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request at ffmpeg.org with subject "unsubscribe".