[FFmpeg-devel] [PATCH] fftools/ffprobe: Fix hypothetical stack buffer overflow

* [FFmpeg-devel] [PATCH] fftools/ffprobe: Fix hypothetical stack buffer overflow
@ 2025-03-31  8:13 Andreas Rheinhardt
  2025-04-02 14:22 ` Andreas Rheinhardt
  0 siblings, 1 reply; 2+ messages in thread
From: Andreas Rheinhardt @ 2025-03-31  8:13 UTC (permalink / raw)
  To: FFmpeg development discussions and patches

[-- Attachment #1: Type: text/plain, Size: 27 bytes --]

Patch attached.

- Andreas

[-- Attachment #2: 0001-fftools-ffprobe-Fix-hypothetical-stack-buffer-overfl.patch --]
[-- Type: text/x-patch, Size: 988 bytes --]

From 5cdf81c1ccd02ed02ed3d99f75e115f2984268b2 Mon Sep 17 00:00:00 2001
From: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Date: Mon, 31 Mar 2025 10:01:07 +0200
Subject: [PATCH] fftools/ffprobe: Fix hypothetical stack buffer overflow

It can't really happen, because no currently used pixel format
has a name exceeding the size of the buffer.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
---
 fftools/ffprobe.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fftools/ffprobe.c b/fftools/ffprobe.c
index ccc046c560..8db4b47efb 100644
--- a/fftools/ffprobe.c
+++ b/fftools/ffprobe.c
@@ -2669,7 +2669,8 @@ static void print_pixel_format(WriterContext *w, enum AVPixelFormat pix_fmt)
         while (s[i] && s[i] == s2[i])
             i++;
 
-        memcpy(buf, s, FFMIN(sizeof(buf) - 1, i));
+        i = FFMIN(sizeof(buf) - 1, i);
+        memcpy(buf, s, i);
         buf[i] = '\0';
 
         print_str    ("pix_fmt", buf);
-- 
2.45.2


[-- Attachment #3: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

^ permalink raw reply	[flat|nested] 2+ messages in thread