avformat/concat: check the terminating character returned by av_get_token()
authorJames Almer <jamrial@gmail.com>
Tue, 27 Jul 2021 15:00:03 +0000 (12:00 -0300)
committerJames Almer <jamrial@gmail.com>
Tue, 27 Jul 2021 15:13:32 +0000 (12:13 -0300)
Don't attempt to increase the cursor pointer if it was \0.
Fixes invalid reads.

Reviewed-by: Marton Balint <cus@passwd.hu>
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: James Almer <jamrial@gmail.com>
libavformat/concat.c

index aec1f52..2560811 100644 (file)
@@ -251,7 +251,8 @@ static av_cold int concatf_open(URLContext *h, const char *uri, int flags)
             err = AVERROR(ENOMEM);
             break;
         }
-        cursor++;
+        if (*cursor)
+            cursor++;
 
         if (++len == SIZE_MAX / sizeof(*nodes)) {
             av_free(node_uri);