parse_filter() did not check the return value of av_get_token() for success; in case name (the name of a filter) was NULL, one got a segfault in av_strlcpy() (called from create_filter()).
Showing the changes to libavfilter/graphparser.c (1 of 1 file). Show all
Unified · Split
| @@ -186,9 +186,16 @@ static int parse_filter(AVFilterContext **filt_ctx, const char **buf, AVFilterGr · 185 unmodified lines | ||
| 186 | 186 | char *name = av_get_token(buf, "=,;["); |
| 187 | 187 | int ret; |
| 188 | 188 | |
| 189 | + if (!name) | |
| 190 | + return AVERROR(ENOMEM); | |
| 191 | + | |
| 189 | 192 | if (**buf == '=') { |
| 190 | 193 | (*buf)++; |
| 191 | 194 | opts = av_get_token(buf, "[],;"); |
| 195 | + if (!opts) { | |
| 196 | + av_free(name); | |
| 197 | + return AVERROR(ENOMEM); | |
| 198 | + } | |
| 192 | 199 | } |
| 193 | 200 | |
| 194 | 201 | ret = create_filter(filt_ctx, graph, index, name, opts, log_ctx); |