ffmpeg | branch: master | Andreas Rheinhardt <andreas.rheinha...@outlook.com> | Wed Sep 28 19:38:01 2022 +0200| [63b31565584e7aaef9c43ca9c0c7a44c6cbc9e97] | committer: Andreas Rheinhardt
avformat/aviobuf: Don't use NULL as src for memcpy This might happen in avio_write() if size == 0 when the direct codepath is taken. It is undefined behaviour according to the spec although it happens to work in practice. Fixes the webm-webvtt-remux FATE-test under UBSan. Reviewed-by: James Almer <jamr...@gmail.com> Signed-off-by: Andreas Rheinhardt <andreas.rheinha...@outlook.com> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=63b31565584e7aaef9c43ca9c0c7a44c6cbc9e97 --- libavformat/aviobuf.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/libavformat/aviobuf.c b/libavformat/aviobuf.c index b20b1a611a..257535a964 100644 --- a/libavformat/aviobuf.c +++ b/libavformat/aviobuf.c @@ -231,12 +231,14 @@ void ffio_fill(AVIOContext *s, int b, int64_t count) void avio_write(AVIOContext *s, const unsigned char *buf, int size) { + if (size <= 0) + return; if (s->direct && !s->update_checksum) { avio_flush(s); writeout(s, buf, size); return; } - while (size > 0) { + do { int len = FFMIN(s->buf_end - s->buf_ptr, size); memcpy(s->buf_ptr, buf, len); s->buf_ptr += len; @@ -246,7 +248,7 @@ void avio_write(AVIOContext *s, const unsigned char *buf, int size) buf += len; size -= len; - } + } while (size > 0); } void avio_flush(AVIOContext *s) _______________________________________________ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
