Traneptora/FFmpeg
1
Fork 0
forked from FFmpeg/FFmpeg
Code Pull requests Activity

fftools/ffmpeg_opt: Check before accessing union member

Browse source 
OptionDef.u is only an offset (i.e. its off member) iff OPT_FLAG_OFFSET
is true. Otherwise, the pointer arithmetic can be undefined behaviour.
UBSan warns about this (on 32bit arches):
src/fftools/ffmpeg_opt.c:102:15: runtime error: pointer index expression with base 0xffa4db10 overflowed to 0x56059a50

This commit fixes this by checking for OPT_FLAG_OFFSET first.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
This commit is contained in:
Andreas Rheinhardt 2024-03-12 23:58:48 +01:00
parent c3d3f0e697
commit 1faafe738d
1 changed files with 7 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
fftools/ffmpeg_opt.c
View file

@ -94,13 +94,16 @@ int recast_media = 0;
static void uninit_options(OptionsContext *o) static void uninit_options(OptionsContext *o)
{ {
const OptionDef *po = options;
int i; int i;
/* all OPT_SPEC and OPT_TYPE_STRING can be freed in generic way */ /* all OPT_SPEC and OPT_TYPE_STRING can be freed in generic way */
while (po->name) { for (const OptionDef *po = options; po->name; po++) {
void *dst = (uint8_t*)o + po->u.off; void *dst;
if (!(po->flags & OPT_FLAG_OFFSET))
continue;
dst = (uint8_t*)o + po->u.off;
if (po->flags & OPT_FLAG_SPEC) { if (po->flags & OPT_FLAG_SPEC) {
SpecifierOptList *so = dst; SpecifierOptList *so = dst;
for (int i = 0; i < so->nb_opt; i++) { for (int i = 0; i < so->nb_opt; i++) {
@ -110,9 +113,8 @@ static void uninit_options(OptionsContext *o)
} }
av_freep(&so->opt); av_freep(&so->opt);
so->nb_opt = 0; so->nb_opt = 0;
} else if (po->flags & OPT_FLAG_OFFSET && po->type == OPT_TYPE_STRING) } else if (po->type == OPT_TYPE_STRING)
av_freep(dst); av_freep(dst);
po++;
} }
for (i = 0; i < o->nb_stream_maps; i++) for (i = 0; i < o->nb_stream_maps; i++)