RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avformat/dashdec: Fix crash on invalid input/ENOMEM, fix leak 

In case a SupplementalProperty node exists in an adaptationset,
it is searched for a "schemeIdUri" property via xmlGetProp().
Whatever xmlGetProp() returns is then compared via av_strcasecmp()
to a string literal. xmlGetProp() can return NULL, namely in case
no "schemeIdUri" exists and (given that this string is allocated)
presumably also on allocation failure. No check for NULL is done,
so this may crash.

Furthermore, the string returned by xmlGetProp() needs to be freed
with xmlFree(), but this is not done either.

This commit fixes both of these issues; they existed since this code
has been added in 10d008f0fd.

This has been found while investigating ticket #9697. The continuous
leaks might very well be the reason behind the observed slowdown.

Reviewed-by: Steven Liu <lingjiujianke@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
This commit is contained in:
Andreas Rheinhardt 2022-09-20 22:08:47 +02:00
parent 05cff214b9
commit 14b3830b33
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
libavformat/dashdec.c
View File

@ -956,7 +956,11 @@ static int parse_manifest_representation(AVFormatContext *s, const char *url,
xmlFree(val);
}
if (adaptionset_supplementalproperty_node) {
if (!av_strcasecmp(xmlGetProp(adaptionset_supplementalproperty_node,"schemeIdUri"), "http://dashif.org/guidelines/last-segment-number")) {
char *scheme_id_uri = xmlGetProp(adaptionset_supplementalproperty_node, "schemeIdUri");
if (scheme_id_uri) {
int is_last_segment_number = !av_strcasecmp(scheme_id_uri, "http://dashif.org/guidelines/last-segment-number");
xmlFree(scheme_id_uri);
if (is_last_segment_number) {
val = xmlGetProp(adaptionset_supplementalproperty_node,"value");
if (!val) {
av_log(s, AV_LOG_ERROR, "Missing value attribute in adaptionset_supplementalproperty_node\n");
@ -965,6 +969,7 @@ static int parse_manifest_representation(AVFormatContext *s, const char *url,
xmlFree(val);
}
}
}
}
fragment_timeline_node = find_child_node_by_name(representation_segmenttemplate_node, "SegmentTimeline");