RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

fftools/ffmpeg_opt: Check before accessing union member 

OptionDef.u is only an offset (i.e. its off member) iff OPT_FLAG_OFFSET
is true. Otherwise, the pointer arithmetic can be undefined behaviour.
UBSan warns about this (on 32bit arches):
src/fftools/ffmpeg_opt.c:102:15: runtime error: pointer index expression with base 0xffa4db10 overflowed to 0x56059a50

This commit fixes this by checking for OPT_FLAG_OFFSET first.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
This commit is contained in:
Andreas Rheinhardt 2024-03-12 23:58:48 +01:00
parent c3d3f0e697
commit 1faafe738d
1 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
fftools/ffmpeg_opt.c
View File

@ -94,13 +94,16 @@ int recast_media = 0;
static void uninit_options(OptionsContext *o)
{
const OptionDef *po = options;
int i;
/* all OPT_SPEC and OPT_TYPE_STRING can be freed in generic way */
while (po->name) {
void *dst = (uint8_t*)o + po->u.off;
for (const OptionDef *po = options; po->name; po++) {
void *dst;
if (!(po->flags & OPT_FLAG_OFFSET))
continue;
dst = (uint8_t*)o + po->u.off;
if (po->flags & OPT_FLAG_SPEC) {
SpecifierOptList *so = dst;
for (int i = 0; i < so->nb_opt; i++) {
@ -110,9 +113,8 @@ static void uninit_options(OptionsContext *o)
}
av_freep(&so->opt);
so->nb_opt = 0;
} else if (po->flags & OPT_FLAG_OFFSET && po->type == OPT_TYPE_STRING)
} else if (po->type == OPT_TYPE_STRING)
av_freep(dst);
po++;
}
for (i = 0; i < o->nb_stream_maps; i++)