Found by reviewing code related to CID1500301 String not null terminated
Unified · Split
| @@ -203,6 +203,8 @@ static int extradata2psets(AVFormatContext *s, const AVCodecParameters *par, · 202 unmodified lines | ||
| 203 | 203 | continue; |
| 204 | 204 | } |
| 205 | 205 | if (p != (psets + strlen(pset_string))) { |
| 206 | + if (p - psets >= MAX_PSET_SIZE) | |
| 207 | + goto fail_in_loop; | |
| 206 | 208 | *p = ','; |
| 207 | 209 | p++; |
| 208 | 210 | } |
| @@ -213,6 +215,7 @@ static int extradata2psets(AVFormatContext *s, const AVCodecParameters *par, · 4 unmodified lines | ||
| 213 | 215 | if (!av_base64_encode(p, MAX_PSET_SIZE - (p - psets), r, r1 - r)) { |
| 214 | 216 | av_log(s, AV_LOG_ERROR, "Cannot Base64-encode %"PTRDIFF_SPECIFIER" %"PTRDIFF_SPECIFIER"!\n", |
| 215 | 217 | MAX_PSET_SIZE - (p - psets), r1 - r); |
| 218 | +fail_in_loop: | |
| 216 | 219 | av_free(psets); |
| 217 | 220 | av_free(tmpbuf); |
| 218 | 221 | |