avformat/concat: check the terminating character returned by av_get_token()

Don't attempt to increase the cursor pointer if it was \0.
Fixes invalid reads.

Reviewed-by: Marton Balint <cus@passwd.hu>
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: James Almer <jamrial@gmail.com>
This commit is contained in:
James Almer 2021-07-27 12:00:03 -03:00
parent bc5faacc3f
commit 487dfa9f04
1 changed files with 2 additions and 1 deletions

View File

@ -251,7 +251,8 @@ static av_cold int concatf_open(URLContext *h, const char *uri, int flags)
err = AVERROR(ENOMEM); err = AVERROR(ENOMEM);
break; break;
} }
cursor++; if (*cursor)
cursor++;
if (++len == SIZE_MAX / sizeof(*nodes)) { if (++len == SIZE_MAX / sizeof(*nodes)) {
av_free(node_uri); av_free(node_uri);