ffserver: fix incorrect strlcpy usage
authorGanesh Ajjanagadde <gajjanagadde@gmail.com>
Fri, 6 Nov 2015 20:47:37 +0000 (15:47 -0500)
committerGanesh Ajjanagadde <gajjanagadde@gmail.com>
Tue, 10 Nov 2015 00:30:26 +0000 (19:30 -0500)
Somewhat ironic that this "safe" interface is actually being used
unsafely here. This fixes the usage preventing potential null pointer
dereference, where the old code was doubly broken: ctime can return
NULL, and ctime can return an arbitrarily long buffer.

Reviewed-by: Mark Harris <mark.hsj@gmail.com>
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Ganesh Ajjanagadde <gajjanagadde@gmail.com>
ffserver.c

index 526cbfc..577ca6f 100644 (file)
@@ -305,15 +305,19 @@ static void ffm_set_write_index(AVFormatContext *s, int64_t pos,
     ffm->file_size = file_size;
 }
 
-static char *ctime1(char *buf2, int buf_size)
+static char *ctime1(char *buf2, size_t buf_size)
 {
     time_t ti;
     char *p;
 
     ti = time(NULL);
     p = ctime(&ti);
+    if (!p || !*p) {
+        *buf2 = '\0';
+        return buf2;
+    }
     av_strlcpy(buf2, p, buf_size);
-    p = buf2 + strlen(p) - 1;
+    p = buf2 + strlen(buf2) - 1;
     if (*p == '\n')
         *p = '\0';
     return buf2;