parse_filter() did not check the return value of av_get_token() for success; in case name (the name of a filter) was NULL, one got a segfault in av_strlcpy() (called from create_filter()).
Showing the changes to libavfilter/graphparser.c (1 of 1 file). Show all
Unified · Split
| @@ -186,9 +186,16 @@ static int parse_filter(AVFilterContext **filt_ctx, const char **buf, AVFilterGr · 185 unmodified lines | |||
| 186 | char *name = av_get_token(buf, "=,;["); | 186 | char *name = av_get_token(buf, "=,;["); |
| 187 | int ret; | 187 | int ret; |
| 188 | 188 | ||
| 189 | if (!name) | ||
| 190 | return AVERROR(ENOMEM); | ||
| 191 | |||
| 189 | if (**buf == '=') { | 192 | if (**buf == '=') { |
| 190 | (*buf)++; | 193 | (*buf)++; |
| 191 | opts = av_get_token(buf, "[],;"); | 194 | opts = av_get_token(buf, "[],;"); |
| 195 | if (!opts) { | ||
| 196 | av_free(name); | ||
| 197 | return AVERROR(ENOMEM); | ||
| 198 | } | ||
| 192 | } | 199 | } |
| 193 | 200 | ||
| 194 | ret = create_filter(filt_ctx, graph, index, name, opts, log_ctx); | 201 | ret = create_filter(filt_ctx, graph, index, name, opts, log_ctx); |