sysutils/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-10-24 02:09:03 +03:00
Code Activity

avformat/dashdec: bound the root URL copy by the size of tmp_str

Browse Source 
Allocate tmp_str with room for the slash appended to the root URL and
the terminating null, like path, and bound the copy of the root URL and
the BaseURL concatenation by that size instead of by the length of the
root URL.

Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
This commit is contained in:
Kacper Michajłow
2026-10-15 17:24:32 +02:00
parent 2fd864c2e9
commit c64a6bdbf0
1 changed files with 3 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
libavformat/dashdec.c
View File

@@ -770,7 +770,7 @@ static int resolve_content_path(AVFormatContext *s, const char *url, int *max_ur
av_free(text);
path = av_mallocz(tmp_max_url_size + 2);
tmp_str = av_mallocz(tmp_max_url_size);
tmp_str = av_mallocz(tmp_max_url_size + 2);
if (!tmp_str || !path) {
updated = AVERROR(ENOMEM);
goto end;
@@ -817,7 +817,6 @@ static int resolve_content_path(AVFormatContext *s, const char *url, int *max_ur
if (size > 0 && root_url[size - 1] != token) {
av_strlcat(root_url, "/", size + 2);
size += 2;
}
for (i = 0; i < n_baseurl_nodes; ++i) {
@@ -828,7 +827,7 @@ static int resolve_content_path(AVFormatContext *s, const char *url, int *max_ur
if (text && !av_strstart(text, "/", NULL)) {
memset(tmp_str, 0, strlen(tmp_str));
if (!ishttp(text) && isRootHttp) {
av_strlcpy(tmp_str, root_url, size + 1);
av_strlcpy(tmp_str, root_url, tmp_max_url_size + 2);
}
start = (text[0] == token);
if (start && av_stristr(tmp_str, text)) {
@@ -841,7 +840,7 @@ static int resolve_content_path(AVFormatContext *s, const char *url, int *max_ur
p = strchr(p, '/');
memset(p + 1, 0, strlen(p));
}
av_strlcat(tmp_str, text + start, tmp_max_url_size);
av_strlcat(tmp_str, text + start, tmp_max_url_size + 2);
xmlFree(text);
xmlChar* escaped = xmlEncodeSpecialChars(NULL, tmp_str);
if (!escaped) {