wrapper/FFmpeg
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

avutil/avstring: shrink allocation from av_get_token to fit token

Browse source 
av_get_token() allocates an output buffer with the same size as the
input. Generally, this is harmless, but when the input string is large
and consists of many small tokens, calling av_get_token() repeatedly to
extract all tokens will significantly amplify memory allocations.

To fix this, after obtaining the return value, simply realloc the buffer
to the actual size needed for output string.

Fixes OOM when parsing filter graph string.
Fixes OSS-Fuzz: 394983446

Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
This commit is contained in:
Kacper Michajłow 2025-07-04 19:56:59 +02:00
parent 86670fec9c
commit 6f88b90f6c
1 changed files with 3 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

5
libavutil/avstring.c
View file

@ -142,7 +142,7 @@ end:
char *av_get_token(const char **buf, const char *term)
{
char *out = av_malloc(strlen(*buf) + 1);
char *out = av_realloc(NULL, strlen(*buf) + 1);
char *ret = out, *end = out;
const char *p = *buf;
if (!out)
@ -172,7 +172,8 @@ char *av_get_token(const char **buf, const char *term)
*buf = p;
return ret;
char *small_ret = av_realloc(ret, out - ret + 2);
return small_ret ? small_ret : ret;
}
char *av_strtok(char *s, const char *delim, char **saveptr)