This happened in parse_link_name() if there was a '[' without matching ']'. While this is not undefined behaviour (pointer arithmetic one beyond the end of an array works fine as long as there are no accesses), it is potentially dangerous. It currently isn't (all callers of parse_link_name() treat this as an error and don't access the string any more), but making sure that this will never cause trouble in the future seems nevertheless worthwhile.
Showing the changes to libavfilter/graphparser.c (1 of 1 file). Show all
Unified · Split
| @@ -63,7 +63,7 @@ static char *parse_link_name(const char **buf, void *log_ctx) · 62 unmodified lines | ||
| 63 | 63 | |
| 64 | 64 | name = av_get_token(buf, "]"); |
| 65 | 65 | if (!name) |
| 66 | − goto fail; | |
| 66 | + return NULL; | |
| 67 | 67 | |
| 68 | 68 | if (!name[0]) { |
| 69 | 69 | av_log(log_ctx, AV_LOG_ERROR, |
| @@ -71,12 +71,14 @@ static char *parse_link_name(const char **buf, void *log_ctx) · 1 unmodified line | ||
| 71 | 71 | goto fail; |
| 72 | 72 | } |
| 73 | 73 | |
| 74 | − if (*(*buf)++ != ']') { | |
| 74 | + if (**buf != ']') { | |
| 75 | 75 | av_log(log_ctx, AV_LOG_ERROR, |
| 76 | 76 | "Mismatched '[' found in the following: \"%s\".\n", start); |
| 77 | 77 | fail: |
| 78 | 78 | av_freep(&name); |
| 79 | + return NULL; | |
| 79 | 80 | } |
| 81 | + (*buf)++; | |
| 80 | 82 | |
| 81 | 83 | return name; |
| 82 | 84 | } |