avformat/dashdec: fix segfault when parsing segmentlist
authorvectronic <hello.vectronic@gmail.com>
Mon, 16 Sep 2019 10:44:28 +0000 (11:44 +0100)
committerSteven Liu <lq@chinaffmpeg.org>
Mon, 23 Sep 2019 02:06:46 +0000 (10:06 +0800)
index into segmentlists_tab was specified as 4 instead of 3 causing invalid access

further fix to: 8135

Reviewed-by: Steven Liu <lq@onvideo.cn>
Signed-off-by: vectronic <hello.vectronic@gmail.com>
libavformat/dashdec.c

index 738bfea..7713ee8 100644 (file)
@@ -1017,7 +1017,7 @@ static int parse_manifest_representation(AVFormatContext *s, const char *url,
 
             duration_val = get_val_from_nodes_tab(segmentlists_tab, 3, "duration");
             timescale_val = get_val_from_nodes_tab(segmentlists_tab, 3, "timescale");
-            startnumber_val = get_val_from_nodes_tab(segmentlists_tab, 4, "startNumber");
+            startnumber_val = get_val_from_nodes_tab(segmentlists_tab, 3, "startNumber");
             if (duration_val) {
                 rep->fragment_duration = (int64_t) strtoll(duration_val, NULL, 10);
                 av_log(s, AV_LOG_TRACE, "rep->fragment_duration = [%"PRId64"]\n", rep->fragment_duration);