Commit 1030993d authored by Andreas Rheinhardt's avatar Andreas Rheinhardt

avformat/webmdashenc: Be more strict when parsing stream indices

The syntax of the adaptation_sets string by which the user determines
the mapping of AVStreams to adaptation sets is
"id=x,streams=a,b,c id=y,streams=d,e" (means: the streams with the
indices a, b and c belong to the adaptation set with id x). Yet there
was no check for whether these indices were actual numbers and if there
is a number whether it really extends to the next ',', ' ' or to the
end of the string or not. This commit adds a check for this.
Signed-off-by: 's avatarAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
parent 325c9014
...@@ -465,18 +465,18 @@ static int parse_adaptation_sets(AVFormatContext *s) ...@@ -465,18 +465,18 @@ static int parse_adaptation_sets(AVFormatContext *s)
state = parsing_streams; state = parsing_streams;
} else if (state == parsing_streams) { } else if (state == parsing_streams) {
struct AdaptationSet *as = &w->as[w->nb_as - 1]; struct AdaptationSet *as = &w->as[w->nb_as - 1];
int64_t num;
int ret = av_reallocp_array(&as->streams, ++as->nb_streams, int ret = av_reallocp_array(&as->streams, ++as->nb_streams,
sizeof(*as->streams)); sizeof(*as->streams));
if (ret < 0) if (ret < 0)
return ret; return ret;
q = p; num = strtoll(p, &q, 10);
while (*q != '\0' && *q != ',' && *q != ' ') q++; if (!av_isdigit(*p) || (*q != ' ' && *q != '\0' && *q != ',') ||
as->streams[as->nb_streams - 1] = strtoll(p, NULL, 10); num < 0 || num >= s->nb_streams) {
if (as->streams[as->nb_streams - 1] < 0 ||
as->streams[as->nb_streams - 1] >= s->nb_streams) {
av_log(s, AV_LOG_ERROR, "Invalid value for 'streams' in adapation_sets.\n"); av_log(s, AV_LOG_ERROR, "Invalid value for 'streams' in adapation_sets.\n");
return AVERROR(EINVAL); return AVERROR(EINVAL);
} }
as->streams[as->nb_streams - 1] = num;
if (*q == '\0') break; if (*q == '\0') break;
if (*q == ' ') state = new_set; if (*q == ' ') state = new_set;
p = ++q; p = ++q;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment