PR #23666 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23666 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23666.patch
Fixes: NULL pointer dereference Fixes: drRnUHy1N0XR Fixes: 8db4ef3e6d9377d131e7051dcebf41fa6cc9ac81 (avformat/dashdec.c: Download dash content with byte range info) Found-by: Pavel Kohout (Aisle Research) Signed-off-by: Michael Niedermayer <[email protected]> >From a6d27e2fa16ac2a41b63186285ff8b37d0f6ec2b Mon Sep 17 00:00:00 2001 From: Pavel Kohout <[email protected]> Date: Tue, 30 Jun 2026 21:56:18 +0200 Subject: [PATCH] avformat/dashdec: handle range strings without two offsets Fixes: NULL pointer dereference Fixes: drRnUHy1N0XR Fixes: 8db4ef3e6d9377d131e7051dcebf41fa6cc9ac81 (avformat/dashdec.c: Download dash content with byte range info) Found-by: Pavel Kohout (Aisle Research) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/dashdec.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c index 0ffab1e889..38bbaf1d95 100644 --- a/libavformat/dashdec.c +++ b/libavformat/dashdec.c @@ -598,8 +598,12 @@ static struct fragment *get_fragment(char *range) seg->size = -1; if (range) { - char *str_end_offset; + char *str_end_offset = NULL; char *str_offset = av_strtok(range, "-", &str_end_offset); + if (!str_offset || !str_end_offset) { + av_free(seg); + return NULL; + } seg->url_offset = strtoll(str_offset, NULL, 10); seg->size = strtoll(str_end_offset, NULL, 10) - seg->url_offset + 1; } -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
