[FFmpeg-devel] [PATCH] urlconcat protocol
Michele Orrù
maker.py
Mon Feb 1 22:53:17 CET 2010
2010/1/31 Michael Niedermayer <michaelni at gmx.at>
> On Sat, Jan 30, 2010 at 11:35:56PM +0100, Michele Orr? wrote:
> [...]
> > +static int urlconcat_open(URLContext *h, const char *uri, int flags)
> > +{
> > + char *upath = NULL;
> > + int err = 0;
> > + int64_t size;
> > + size_t len, i;
> > + URLContext *uc;
> > + struct urlconcat_data *udata;
> > + struct urlconcat_nodes *unodes;
> > +
> > + av_strstart(uri, "cat:", &uri);
> > +
> > + /* creating udata */
> > + if (!(udata = av_mallocz(sizeof(*udata))))
> > + return AVERROR(ENOMEM);
> > + h->priv_data = udata;
> > + /* creating udata->urls */
> > + for (i=0, len = 1; uri[i]; i++) /* cat:[url]|[url] -> urls = sep+1
> */
> > + if (uri[i] == *AV_CAT_SEPARATOR) len++;
> > + if (!(unodes = av_malloc(sizeof(*unodes) * len))) {
>
> integer overflow that could lead to a too small buffer to be allocated
>
Oh, that's right. Fixed with a simple check, but.. If you don't like this
solution I can recycle the old linked list approach.
>
> > + av_free(udata);
> > + h->priv_data = NULL;
> > + return AVERROR(ENOMEM);
> > + } else
> > + udata->urls = unodes;
> > +
> > + /* handle input */
> > + if (!*uri) err = AVERROR(ENOENT);
> > + for (i = 0; *uri; i++) {
> > + /* parsing uri */
> > + len = strcspn(uri, AV_CAT_SEPARATOR);
>
> > + upath = av_realloc(upath, len);
> > + if (!upath) {
> > + err = AVERROR(ENOMEM);
> > + break;
> > + }
>
> memleak, av_realloc() does not free its input buffer if it returns NULL
>
Added a check here, too
.
>
>
> > + av_strlcpy(upath, uri, len+1);
>
> +1 ?
>
yep. ._.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: uconcatp.patch
Type: application/octet-stream
Size: 6701 bytes
Desc: not available
URL: <http://lists.mplayerhq.hu/pipermail/ffmpeg-devel/attachments/20100201/fc7a0fe5/attachment.obj>
More information about the ffmpeg-devel
mailing list