MrBesen/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

fftools/ffmpeg_mux_init: Fix attachment_filename use-after-free

Browse Source 
The filename is freed with the OptionsContext and therefore
there will be a use-after-free when reporting the filename
in print_stream_maps(). So create a copy of the string.

This is a regression since 8aed3911fc.
fate-lavf-mkv_attachment exhibits it (and reports a random nonsense
filename here), but this does not make the test fail (not even with
valgrind; only with ASAN, as it aborts on use-after-free).

Reviewed-by: Anton Khirnov <anton@khirnov.net>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
This commit is contained in:
Andreas Rheinhardt 2024-02-18 15:19:49 +01:00
parent 32538dafca
commit 44620ade25
3 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
fftools/ffmpeg.h
View File

@ -555,7 +555,7 @@ typedef struct OutputStream {
AVDictionary *swr_opts;
char *apad;
const char *attachment_filename;
char *attachment_filename;
int keep_pix_fmt;

2
fftools/ffmpeg_mux.c
View File

@ -817,6 +817,8 @@ static void ost_free(OutputStream **post)
av_freep(&ost->logfile_prefix);
av_freep(&ost->apad);
av_freep(&ost->attachment_filename);
#if FFMPEG_OPT_MAP_CHANNEL
av_freep(&ost->audio_channels_map);
ost->audio_channels_mapped = 0;

10
fftools/ffmpeg_mux_init.c
View File

@ -1741,6 +1741,7 @@ static int of_add_attachments(Muxer *mux, const OptionsContext *o)
for (int i = 0; i < o->nb_attachments; i++) {
AVIOContext *pb;
uint8_t *attachment;
char *attachment_filename;
const char *p;
int64_t len;
@ -1788,13 +1789,20 @@ read_fail:
av_log(mux, AV_LOG_VERBOSE, "Creating attachment stream from file %s\n",
o->attachments[i]);
attachment_filename = av_strdup(o->attachments[i]);
if (!attachment_filename) {
av_free(attachment);
return AVERROR(ENOMEM);
}
err = ost_add(mux, o, AVMEDIA_TYPE_ATTACHMENT, NULL, NULL, &ost);
if (err < 0) {
av_free(attachment_filename);
av_freep(&attachment);
return err;
}
ost->attachment_filename = o->attachments[i];
ost->attachment_filename = attachment_filename;
ost->par_in->extradata = attachment;
ost->par_in->extradata_size = len;