The following pattern is unsafe on all platforms: n = SNPRINTF(buf, ...); buf[n] = '\0'; On windows, the _snprintf variants return a negative number if the buffer was too small, thus buf[n] would be outside of (before the start of) the buffer. On other platforms, the C99 snprintf function returns the total number of characters which would have been written if the buffer had been large enough, which can be larger than the buffer size itself, and thus buf[n] would be beyond the end of the buffer. The C99 snprintf function always null terminate the buffer. These invocations of SNPRINTF are within !WIN32, so we can be sure that the SNPRINTF call itself already null terminated the buffer.
Showing the changes to codec/encoder/core/src/slice_multi_threading.cpp (1 of 1 file). Show all
Unified · Split
| @@ -443,7 +443,6 @@ int32_t RequestMtResource (sWelsEncCtx** ppCtx, SWelsSvcCodingParam* pCodingPara · 442 unmodified lines | ||
| 443 | 443 | while (iIdx < iThreadNum) { |
| 444 | 444 | #if defined(__GNUC__) && !defined(_WIN32) // for posix threading |
| 445 | 445 | str_t name[SEM_NAME_MAX] = {0}; |
| 446 | − int32_t used_len = 0; | |
| 447 | 446 | WELS_THREAD_ERROR_CODE err = 0; |
| 448 | 447 | #endif//__GNUC__ |
| 449 | 448 | pSmt->pThreadPEncCtx[iIdx].pWelsPEncCtx = (void*) (*ppCtx); |
| @@ -462,8 +461,7 @@ int32_t RequestMtResource (sWelsEncCtx** ppCtx, SWelsSvcCodingParam* pCodingPara · 12 unmodified lines | ||
| 462 | 461 | #if defined(ENABLE_TRACE_MT) |
| 463 | 462 | WelsLog ((*ppCtx), WELS_LOG_INFO, "[MT] Open pUpdateMbListEvent%d named(%s) ret%d err%d\n", iIdx, name, err, errno); |
| 464 | 463 | #endif |
| 465 | − used_len = SNPRINTF (name, SEM_NAME_MAX, "fu%d%p", iIdx, (void*) (*ppCtx)); | |
| 466 | − name[used_len] = '\0'; | |
| 464 | + SNPRINTF (name, SEM_NAME_MAX, "fu%d%p", iIdx, (void*) (*ppCtx)); | |
| 467 | 465 | err = WelsEventOpen (&pSmt->pFinUpdateMbListEvent[iIdx], name); |
| 468 | 466 | #if defined(ENABLE_TRACE_MT) |
| 469 | 467 | WelsLog ((*ppCtx), WELS_LOG_INFO, "[MT] Open pFinUpdateMbListEvent%d named(%s) ret%d err%d\n", iIdx, name, err, errno); |
| @@ -477,14 +475,12 @@ int32_t RequestMtResource (sWelsEncCtx** ppCtx, SWelsSvcCodingParam* pCodingPara · 7 unmodified lines | ||
| 477 | 475 | WelsEventInit (&pSmt->pFinSliceCodingEvent[iIdx]); |
| 478 | 476 | WelsEventInit (&pSmt->pExitEncodeEvent[iIdx]); |
| 479 | 477 | #else |
| 480 | − used_len = SNPRINTF (name, SEM_NAME_MAX, "sc%d%p", iIdx, (void*) (*ppCtx)); | |
| 481 | − name[used_len] = '\0'; | |
| 478 | + SNPRINTF (name, SEM_NAME_MAX, "sc%d%p", iIdx, (void*) (*ppCtx)); | |
| 482 | 479 | err = WelsEventOpen (&pSmt->pSliceCodedEvent[iIdx], name); |
| 483 | 480 | #if defined(ENABLE_TRACE_MT) |
| 484 | 481 | WelsLog ((*ppCtx), WELS_LOG_INFO, "[MT] Open pSliceCodedEvent%d named(%s) ret%d err%d\n", iIdx, name, err, errno); |
| 485 | 482 | #endif |
| 486 | − used_len = SNPRINTF (name, SEM_NAME_MAX, "rc%d%p", iIdx, (void*) (*ppCtx)); | |
| 487 | − name[used_len] = '\0'; | |
| 483 | + SNPRINTF (name, SEM_NAME_MAX, "rc%d%p", iIdx, (void*) (*ppCtx)); | |
| 488 | 484 | err = WelsEventOpen (&pSmt->pReadySliceCodingEvent[iIdx], name); |
| 489 | 485 | #if defined(ENABLE_TRACE_MT) |
| 490 | 486 | WelsLog ((*ppCtx), WELS_LOG_INFO, "[MT] Open pReadySliceCodingEvent%d = 0x%p named(%s) ret%d err%d\n", iIdx, |
| @@ -577,19 +573,15 @@ void ReleaseMtResource (sWelsEncCtx** ppCtx) { · 86 unmodified lines | ||
| 577 | 573 | #endif//DYNAMIC_SLICE_ASSIGN && TRY_SLICING_BALANCE |
| 578 | 574 | #else |
| 579 | 575 | str_t ename[SEM_NAME_MAX] = {0}; |
| 580 | − int32_t used_len = 0; | |
| 581 | 576 | // length of semaphore name should be system constrained at least on mac 10.7 |
| 582 | 577 | SNPRINTF (ename, SEM_NAME_MAX, "sc%d%p", iIdx, (void*) (*ppCtx)); |
| 583 | 578 | WelsEventClose (pSmt->pSliceCodedEvent[iIdx], ename); |
| 584 | − used_len = SNPRINTF (ename, SEM_NAME_MAX, "rc%d%p", iIdx, (void*) (*ppCtx)); | |
| 585 | − ename[used_len] = '\0'; | |
| 579 | + SNPRINTF (ename, SEM_NAME_MAX, "rc%d%p", iIdx, (void*) (*ppCtx)); | |
| 586 | 580 | WelsEventClose (pSmt->pReadySliceCodingEvent[iIdx], ename); |
| 587 | 581 | #if defined(DYNAMIC_SLICE_ASSIGN) && defined(TRY_SLICING_BALANCE) |
| 588 | − used_len = SNPRINTF (ename, SEM_NAME_MAX, "ud%d%p", iIdx, (void*) (*ppCtx)); | |
| 589 | − ename[used_len] = '\0'; | |
| 582 | + SNPRINTF (ename, SEM_NAME_MAX, "ud%d%p", iIdx, (void*) (*ppCtx)); | |
| 590 | 583 | WelsEventClose (pSmt->pUpdateMbListEvent[iIdx], ename); |
| 591 | − used_len = SNPRINTF (ename, SEM_NAME_MAX, "fu%d%p", iIdx, (void*) (*ppCtx)); | |
| 592 | − ename[used_len] = '\0'; | |
| 584 | + SNPRINTF (ename, SEM_NAME_MAX, "fu%d%p", iIdx, (void*) (*ppCtx)); | |
| 593 | 585 | WelsEventClose (pSmt->pFinUpdateMbListEvent[iIdx], ename); |
| 594 | 586 | #endif//DYNAMIC_SLICE_ASSIGN && TRY_SLICING_BALANCE |
| 595 | 587 | #endif//_WIN32 |