Found by reviewing code related to CID1500301 String not null terminated
Unified · Split
| @@ -203,6 +203,8 @@ static int extradata2psets(AVFormatContext *s, const AVCodecParameters *par, · 202 unmodified lines | |||
| 203 | continue; | 203 | continue; |
| 204 | } | 204 | } |
| 205 | if (p != (psets + strlen(pset_string))) { | 205 | if (p != (psets + strlen(pset_string))) { |
| 206 | if (p - psets >= MAX_PSET_SIZE) | ||
| 207 | goto fail_in_loop; | ||
| 206 | *p = ','; | 208 | *p = ','; |
| 207 | p++; | 209 | p++; |
| 208 | } | 210 | } |
| @@ -213,6 +215,7 @@ static int extradata2psets(AVFormatContext *s, const AVCodecParameters *par, · 4 unmodified lines | |||
| 213 | if (!av_base64_encode(p, MAX_PSET_SIZE - (p - psets), r, r1 - r)) { | 215 | if (!av_base64_encode(p, MAX_PSET_SIZE - (p - psets), r, r1 - r)) { |
| 214 | av_log(s, AV_LOG_ERROR, "Cannot Base64-encode %"PTRDIFF_SPECIFIER" %"PTRDIFF_SPECIFIER"!\n", | 216 | av_log(s, AV_LOG_ERROR, "Cannot Base64-encode %"PTRDIFF_SPECIFIER" %"PTRDIFF_SPECIFIER"!\n", |
| 215 | MAX_PSET_SIZE - (p - psets), r1 - r); | 217 | MAX_PSET_SIZE - (p - psets), r1 - r); |
| 218 | fail_in_loop: | ||
| 216 | av_free(psets); | 219 | av_free(psets); |
| 217 | av_free(tmpbuf); | 220 | av_free(tmpbuf); |
| 218 | 221 | ||