From 63b31565584e7aaef9c43ca9c0c7a44c6cbc9e97 Mon Sep 17 00:00:00 2001 From: Andreas Rheinhardt Date: Wed, 28 Sep 2022 19:38:01 +0200 Subject: [PATCH] avformat/aviobuf: Don't use NULL as src for memcpy This might happen in avio_write() if size == 0 when the direct codepath is taken. It is undefined behaviour according to the spec although it happens to work in practice. Fixes the webm-webvtt-remux FATE-test under UBSan. Reviewed-by: James Almer Signed-off-by: Andreas Rheinhardt --- libavformat/aviobuf.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/libavformat/aviobuf.c b/libavformat/aviobuf.c index b20b1a611a..257535a964 100644 --- a/libavformat/aviobuf.c +++ b/libavformat/aviobuf.c @@ -231,12 +231,14 @@ void ffio_fill(AVIOContext *s, int b, int64_t count) void avio_write(AVIOContext *s, const unsigned char *buf, int size) { + if (size <= 0) + return; if (s->direct && !s->update_checksum) { avio_flush(s); writeout(s, buf, size); return; } - while (size > 0) { + do { int len = FFMIN(s->buf_end - s->buf_ptr, size); memcpy(s->buf_ptr, buf, len); s->buf_ptr += len; @@ -246,7 +248,7 @@ void avio_write(AVIOContext *s, const unsigned char *buf, int size) buf += len; size -= len; - } + } while (size > 0); } void avio_flush(AVIOContext *s)