From: Limin Wang <lance.lmw...@gmail.com>
If an error occurs, avio_get_dyn_buf() will return 0 and buf is NULL, so it's
necessary to check
the return value for the following code will access the buf pointer with index.
In addition,
the buf len should be greater than written_len to avoid the buffer overflow
access.
Signed-off-by: Limin Wang <lance.lmw...@gmail.com>
---
libavformat/dashenc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavformat/dashenc.c b/libavformat/dashenc.c
index 9f83785792..99fb7d67af 100644
--- a/libavformat/dashenc.c
+++ b/libavformat/dashenc.c
@@ -2260,7 +2260,7 @@ static int dash_write_packet(AVFormatContext *s, AVPacket
*pkt)
uint8_t *buf = NULL;
avio_flush(os->ctx->pb);
len = avio_get_dyn_buf (os->ctx->pb, &buf);
- if (os->out) {
+ if (os->out && len > os->written_len) {
avio_write(os->out, buf + os->written_len, len - os->written_len);
avio_flush(os->out);
}
--
2.21.0
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
