[FFmpeg-devel] [PATCH] urlconcat protocol

Michele Orrù maker.py
Mon Feb 1 22:53:17 CET 2010


2010/1/31 Michael Niedermayer <michaelni at gmx.at>

> On Sat, Jan 30, 2010 at 11:35:56PM +0100, Michele Orr? wrote:
> [...]
> > +static int urlconcat_open(URLContext *h, const char *uri, int flags)
> > +{
> > +    char *upath = NULL;
> > +    int err = 0;
> > +    int64_t size;
> > +    size_t  len, i;
> > +    URLContext *uc;
> > +    struct urlconcat_data *udata;
> > +    struct urlconcat_nodes *unodes;
> > +
> > +    av_strstart(uri, "cat:", &uri);
> > +
> > +    /* creating udata */
> > +    if (!(udata = av_mallocz(sizeof(*udata))))
> > +        return AVERROR(ENOMEM);
> > +    h->priv_data = udata;
> > +    /* creating udata->urls */
> > +    for (i=0, len = 1; uri[i]; i++)  /* cat:[url]|[url] -> urls = sep+1
> */
> > +        if (uri[i] == *AV_CAT_SEPARATOR) len++;
> > +    if (!(unodes = av_malloc(sizeof(*unodes) * len))) {
>
> integer overflow that could lead to a too small buffer to be allocated
>

Oh, that's right. Fixed with a simple check, but.. If you don't like this
solution I can recycle the old linked list approach.


>
> > +        av_free(udata);
> > +        h->priv_data = NULL;
> > +        return AVERROR(ENOMEM);
> > +    } else
> > +        udata->urls = unodes;
> > +
> > +    /* handle input */
> > +    if (!*uri) err = AVERROR(ENOENT);
> > +    for (i = 0; *uri; i++) {
> > +        /* parsing uri */
> > +        len = strcspn(uri, AV_CAT_SEPARATOR);
>
> > +        upath = av_realloc(upath, len);
> > +        if (!upath) {
> > +            err = AVERROR(ENOMEM);
> > +            break;
> > +        }
>
> memleak, av_realloc() does not free its input buffer if it returns NULL
>
Added a check here, too
.

>
>
> > +        av_strlcpy(upath, uri, len+1);
>
> +1 ?
>
yep.    ._.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: uconcatp.patch
Type: application/octet-stream
Size: 6701 bytes
Desc: not available
URL: <http://lists.mplayerhq.hu/pipermail/ffmpeg-devel/attachments/20100201/fc7a0fe5/attachment.obj>



More information about the ffmpeg-devel mailing list