From f2b51fd54c44659ef9d6b39abd38b87de6d8848d Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sat, 18 Aug 2018 02:19:51 +0200 Subject: [PATCH] avformat/dashdec: Fix strlen(rep_id_val) with it being NULL Fixes: dash-crash-da39a3ee5e6b4b0d3255bfef95601890afd80709.xml Found-by: Paul Ch Reviewed-by: Steven Liu Signed-off-by: Michael Niedermayer (cherry picked from commit 46753bfdd0182f721499939a1118c0406c8a3674) Signed-off-by: Michael Niedermayer --- libavformat/dashdec.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c index 8bfde4dbce..a51154699f 100644 --- a/libavformat/dashdec.c +++ b/libavformat/dashdec.c @@ -862,7 +862,9 @@ static int parse_manifest_representation(AVFormatContext *s, const char *url, baseurl_nodes[3] = representation_baseurl_node; ret = resolve_content_path(s, url, &c->max_url_size, baseurl_nodes, 4); - c->max_url_size = aligned(c->max_url_size + strlen(rep_id_val) + strlen(rep_bandwidth_val)); + c->max_url_size = aligned(c->max_url_size + + (rep_id_val ? strlen(rep_id_val) : 0) + + (rep_bandwidth_val ? strlen(rep_bandwidth_val) : 0)); if (ret == AVERROR(ENOMEM) || ret == 0) { goto end; }