1
0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-10-28 15:19:38 +03:00
Files
ffmpeg/libavformat/tee_common.c
Michael Niedermayer 6ae78e8554 avformat/tee_common: reject slave options without a closing bracket
Fixes: heap buffer overflow (read)
Fixes: 9EkQ1uliNrFe
Found-by: Zheng Yu @ Depthfirst
2026-09-28 03:36:39 +00:00

76 lines
2.2 KiB
C

/*
* Tee common code
* Copyright (c) 2012 Nicolas George
*
* This file is part of FFmpeg.
*
* FFmpeg is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public License
* as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* FFmpeg is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public License
* along with FFmpeg; if not, write to the Free Software * Foundation, Inc.,
* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*/
#include <string.h>
#include "libavutil/error.h"
#include "libavutil/log.h"
#include "libavutil/opt.h"
#include "tee_common.h"
static const char *const slave_opt_open = "[";
static const char *const slave_opt_close = "]";
static const char *const slave_opt_delim = ":]"; /* must have the close too */
int ff_tee_parse_slave_options(void *log, char *slave,
AVDictionary **options, char **filename)
{
const char *p;
char *key, *val;
int ret;
if (!strspn(slave, slave_opt_open)) {
*filename = slave;
return 0;
}
p = slave + 1;
if (strspn(p, slave_opt_close)) {
*filename = (char *)p + 1;
return 0;
}
while (1) {
ret = av_opt_get_key_value(&p, "=", slave_opt_delim, 0, &key, &val);
if (ret < 0) {
av_log(log, AV_LOG_ERROR, "No option found near \"%s\"\n", p);
goto fail;
}
ret = av_dict_set(options, key, val,
AV_DICT_DONT_STRDUP_KEY | AV_DICT_DONT_STRDUP_VAL);
if (ret < 0)
goto fail;
if (strspn(p, slave_opt_close))
break;
if (!*p) {
av_log(log, AV_LOG_ERROR, "Unterminated slave options in \"%s\"\n", slave);
ret = AVERROR(EINVAL);
goto fail;
}
p++;
}
*filename = (char *)p + 1;
return 0;
fail:
av_dict_free(options);
return ret;
}