[FFmpeg-devel] [PATCH] libavformat/vorbiscomment: fix potential buffer truncation (PR #20858)

[caifan via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>]

PR #20858 opened by caifan
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20858
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20858.patch

add av_assert0() for chapter_time and chapter_number,
ensure buffer size is sufficient to hold formatted strings,
eliminate -Wformat-truncation warning.

Signed-off-by: caifan3 <caifan3@xiaomi.com>


>From c2b190a950d22693a890b16ef8ec23f0d5078723 Mon Sep 17 00:00:00 2001
From: caifan3 <caifan3@xiaomi.com>
Date: Fri, 7 Nov 2025 17:48:09 +0800
Subject: [PATCH] libavformat/vorbiscomment: fix potential buffer truncation

add av_assert0() for chapter_time and chapter_number,
ensure buffer size is sufficient to hold formatted strings,
eliminate -Wformat-truncation warning.

Signed-off-by: caifan3 <caifan3@xiaomi.com>
---
 libavformat/vorbiscomment.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/libavformat/vorbiscomment.c b/libavformat/vorbiscomment.c
index abe12fd586..9a755d8704 100644
--- a/libavformat/vorbiscomment.c
+++ b/libavformat/vorbiscomment.c
@@ -24,6 +24,7 @@
 #include "metadata.h"
 #include "vorbiscomment.h"
 #include "libavutil/dict.h"
+#include "libavutil/avassert.h"
 
 /**
  * VorbisComment metadata conversion mapping.
@@ -100,8 +101,10 @@ int ff_vorbiscomment_write(AVIOContext *pb, const AVDictionary *m,
             m  = (s / 60) % 60;
             ms = av_rescale_q(chp->start, chp->time_base, av_make_q(   1, 1000)) % 1000;
             s  = s % 60;
-            snprintf(chapter_number, sizeof(chapter_number), "%03d", i);
-            snprintf(chapter_time, sizeof(chapter_time), "%02d:%02d:%02d.%03d", h, m, s, ms);
+            int len_num = snprintf(chapter_number, sizeof(chapter_number), "%03d", i);
+            av_assert0(len_num >= 0 && len_num < sizeof(chapter_number));
+            int len_time = snprintf(chapter_time, sizeof(chapter_time), "%02d:%02d:%02d.%03d", h, m, s, ms);
+            av_assert0(len_time >= 0 && len_time < sizeof(chapter_time));
             avio_wl32(pb, 10 + 1 + 12);
             avio_write(pb, "CHAPTER", 7);
             avio_write(pb, chapter_number, 3);
-- 
2.49.1

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org