Mercurial > libavcodec.hg

changeset 10067:685af2860d80 libavcodec

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
eval: replace variable-length array with av_malloc/free There is a theoretical possibility to pass a very long string to ff_parse, which could crash if allocated from the stack. This allows the allocation to be checked properly.
author mru
date Wed, 19 Aug 2009 21:59:40 +0000
parents 3fca809be8ed
children 770294452eaf
files eval.c
diffstat 1 files changed, 9 insertions(+), 3 deletions(-) [+]
line wrap: on
line diff
--- a/eval.c	Wed Aug 19 21:59:36 2009 +0000
+++ b/eval.c	Wed Aug 19 21:59:40 2009 +0000
@@ -369,8 +369,12 @@
                double (**func2)(void *, double, double), const char **func2_name,
                const char **error){
     Parser p;
-    AVEvalExpr * e;
-    char w[strlen(s) + 1], * wp = w;
+    AVEvalExpr *e = NULL;
+    char *w = av_malloc(strlen(s) + 1);
+    char *wp = w;
+
+    if (!w)
+        goto end;
 
     while (*s)
         if (!isspace(*s++)) *wp++ = s[-1];
@@ -388,8 +392,10 @@
     e = parse_expr(&p);
     if (!verify_expr(e)) {
         ff_eval_free(e);
-        return NULL;
+        e = NULL;
     }
+end:
+    av_free(w);
     return e;
 }