* [FFmpeg-devel] [PATCH v1] avformat/imf: fix bad free() when directory name of the input url is empty
@ 2022-01-03 15:59 pal
2022-01-05 1:38 ` Zane van Iperen
0 siblings, 1 reply; 4+ messages in thread
From: pal @ 2022-01-03 15:59 UTC (permalink / raw)
To: ffmpeg-devel; +Cc: Pierre-Anthony Lemieux
From: Pierre-Anthony Lemieux <pal@palemieux.com>
Signed-off-by: Pierre-Anthony Lemieux <pal@palemieux.com>
---
Notes:
Found through manual fuzzing.
libavformat/imfdec.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/libavformat/imfdec.c b/libavformat/imfdec.c
index f17064cfcd..4e42db8d30 100644
--- a/libavformat/imfdec.c
+++ b/libavformat/imfdec.c
@@ -622,11 +622,15 @@ static int imf_read_header(AVFormatContext *s)
int ret = 0;
c->interrupt_callback = &s->interrupt_callback;
+
tmp_str = av_strdup(s->url);
if (!tmp_str)
return AVERROR(ENOMEM);
+ c->base_url = av_strdup(av_dirname(tmp_str));
+ av_freep(&tmp_str);
+ if (!c->base_url)
+ return AVERROR(ENOMEM);
- c->base_url = av_dirname(tmp_str);
if ((ret = ffio_copy_url_options(s->pb, &c->avio_opts)) < 0)
return ret;
--
2.17.1
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [FFmpeg-devel] [PATCH v1] avformat/imf: fix bad free() when directory name of the input url is empty
2022-01-03 15:59 [FFmpeg-devel] [PATCH v1] avformat/imf: fix bad free() when directory name of the input url is empty pal
@ 2022-01-05 1:38 ` Zane van Iperen
2022-01-05 1:44 ` Pierre-Anthony Lemieux
0 siblings, 1 reply; 4+ messages in thread
From: Zane van Iperen @ 2022-01-05 1:38 UTC (permalink / raw)
To: ffmpeg-devel
On 4/1/22 01:59, pal@sandflow.com wrote:
> From: Pierre-Anthony Lemieux <pal@palemieux.com>
>
> Signed-off-by: Pierre-Anthony Lemieux <pal@palemieux.com>
> ---
>
> Notes:
> Found through manual fuzzing.
>
> libavformat/imfdec.c | 6 +++++-
> 1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/libavformat/imfdec.c b/libavformat/imfdec.c
> index f17064cfcd..4e42db8d30 100644
> --- a/libavformat/imfdec.c
> +++ b/libavformat/imfdec.c
> @@ -622,11 +622,15 @@ static int imf_read_header(AVFormatContext *s)
> int ret = 0;
>
> c->interrupt_callback = &s->interrupt_callback;
> +
> tmp_str = av_strdup(s->url);
> if (!tmp_str)
> return AVERROR(ENOMEM);
> + c->base_url = av_strdup(av_dirname(tmp_str));
Is the second av_strdup() here required? You've already done it above
and av_dirname() just sticks a '\0' at the last separator, so it should
be safe to remove it:
if (!(c->base_url = av_strdup(s->url)))
return AVERROR(ENOMEM);
c->base_url = av_dirname(c->base_url);
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [FFmpeg-devel] [PATCH v1] avformat/imf: fix bad free() when directory name of the input url is empty
2022-01-05 1:38 ` Zane van Iperen
@ 2022-01-05 1:44 ` Pierre-Anthony Lemieux
2022-01-05 2:30 ` Zane van Iperen
0 siblings, 1 reply; 4+ messages in thread
From: Pierre-Anthony Lemieux @ 2022-01-05 1:44 UTC (permalink / raw)
To: FFmpeg development discussions and patches
On Tue, Jan 4, 2022 at 5:39 PM Zane van Iperen <zane@zanevaniperen.com> wrote:
>
>
>
> On 4/1/22 01:59, pal@sandflow.com wrote:
> > From: Pierre-Anthony Lemieux <pal@palemieux.com>
> >
> > Signed-off-by: Pierre-Anthony Lemieux <pal@palemieux.com>
> > ---
> >
> > Notes:
> > Found through manual fuzzing.
> >
> > libavformat/imfdec.c | 6 +++++-
> > 1 file changed, 5 insertions(+), 1 deletion(-)
> >
> > diff --git a/libavformat/imfdec.c b/libavformat/imfdec.c
> > index f17064cfcd..4e42db8d30 100644
> > --- a/libavformat/imfdec.c
> > +++ b/libavformat/imfdec.c
> > @@ -622,11 +622,15 @@ static int imf_read_header(AVFormatContext *s)
> > int ret = 0;
> >
> > c->interrupt_callback = &s->interrupt_callback;
> > +
> > tmp_str = av_strdup(s->url);
> > if (!tmp_str)
> > return AVERROR(ENOMEM);
> > + c->base_url = av_strdup(av_dirname(tmp_str));
>
> Is the second av_strdup() here required? You've already done it above
> and av_dirname() just sticks a '\0' at the last separator,
This is what I thought.
> so it should
> be safe to remove it:
As I understand it, av_dirname() actually returns a pointer to its own
"." string when the input is either empty or does not contain, in
which case we must make a copy.
>
> if (!(c->base_url = av_strdup(s->url)))
> return AVERROR(ENOMEM);
>
> c->base_url = av_dirname(c->base_url);
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [FFmpeg-devel] [PATCH v1] avformat/imf: fix bad free() when directory name of the input url is empty
2022-01-05 1:44 ` Pierre-Anthony Lemieux
@ 2022-01-05 2:30 ` Zane van Iperen
0 siblings, 0 replies; 4+ messages in thread
From: Zane van Iperen @ 2022-01-05 2:30 UTC (permalink / raw)
To: ffmpeg-devel
On 5/1/22 11:44, Pierre-Anthony Lemieux wrote:
> On Tue, Jan 4, 2022 at 5:39 PM Zane van Iperen <zane@zanevaniperen.com> wrote:
>>
>>
>>
>> On 4/1/22 01:59, pal@sandflow.com wrote:
>>> From: Pierre-Anthony Lemieux <pal@palemieux.com>
>>>
>>> Signed-off-by: Pierre-Anthony Lemieux <pal@palemieux.com>
>>> ---
>>>
>>> Notes:
>>> Found through manual fuzzing.
>>>
>>> libavformat/imfdec.c | 6 +++++-
>>> 1 file changed, 5 insertions(+), 1 deletion(-)
>>>
>>> diff --git a/libavformat/imfdec.c b/libavformat/imfdec.c
>>> index f17064cfcd..4e42db8d30 100644
>>> --- a/libavformat/imfdec.c
>>> +++ b/libavformat/imfdec.c
>>> @@ -622,11 +622,15 @@ static int imf_read_header(AVFormatContext *s)
>>> int ret = 0;
>>>
>>> c->interrupt_callback = &s->interrupt_callback;
>>> +
>>> tmp_str = av_strdup(s->url);
>>> if (!tmp_str)
>>> return AVERROR(ENOMEM);
>>> + c->base_url = av_strdup(av_dirname(tmp_str));
>>
>> Is the second av_strdup() here required? You've already done it above
>> and av_dirname() just sticks a '\0' at the last separator,
>
> This is what I thought.
>
>> so it should
>> be safe to remove it:
>
> As I understand it, av_dirname() actually returns a pointer to its own
> "." string when the input is either empty or does not contain, in
> which case we must make a copy.
>
You're right. This is ugly, but I don't see a nicer way to do it.
This lgtm then.
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2022-01-05 2:30 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-01-03 15:59 [FFmpeg-devel] [PATCH v1] avformat/imf: fix bad free() when directory name of the input url is empty pal
2022-01-05 1:38 ` Zane van Iperen
2022-01-05 1:44 ` Pierre-Anthony Lemieux
2022-01-05 2:30 ` Zane van Iperen
Git Inbox Mirror of the ffmpeg-devel mailing list - see https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
This inbox may be cloned and mirrored by anyone:
git clone --mirror https://master.gitmailbox.com/ffmpegdev/0 ffmpegdev/git/0.git
# If you have public-inbox 1.1+ installed, you may
# initialize and index your mirror using the following commands:
public-inbox-init -V2 ffmpegdev ffmpegdev/ https://master.gitmailbox.com/ffmpegdev \
ffmpegdev@gitmailbox.com
public-inbox-index ffmpegdev
Example config snippet for mirrors.
AGPL code for this site: git clone https://public-inbox.org/public-inbox.git