X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavformat%2Fwebmdashenc.c;h=26b87273048fe09f34418c03096e02d63261d2a8;hb=c2a221c5ae5017e11654b9688ac97e9f5d3570b2;hp=1280d8a763beea2903361fce0f4ae8adb4f2ad8a;hpb=fef55251d82ca1043689dddf5d03aa96c75cd4bb;p=ffmpeg

diff --git a/libavformat/webmdashenc.c b/libavformat/webmdashenc.c
index 1280d8a763b..26b87273048 100644
--- a/libavformat/webmdashenc.c
+++ b/libavformat/webmdashenc.c
@@ -466,6 +466,7 @@ static int parse_adaptation_sets(AVFormatContext *s)
             continue;
         else if (state == new_set && !strncmp(p, "id=", 3)) {
             void *mem = av_realloc(w->as, sizeof(*w->as) * (w->nb_as + 1));
+            const char *comma;
             if (mem == NULL)
                 return AVERROR(ENOMEM);
             w->as = mem;
@@ -474,6 +475,11 @@ static int parse_adaptation_sets(AVFormatContext *s)
             w->as[w->nb_as - 1].streams = NULL;
             p += 3; // consume "id="
             q = w->as[w->nb_as - 1].id;
+            comma = strchr(p, ',');
+            if (!comma || comma - p >= sizeof(w->as[w->nb_as - 1].id)) {
+                av_log(s, AV_LOG_ERROR, "'id' in 'adaptation_sets' is malformed.\n");
+                return AVERROR(EINVAL);
+            }
             while (*p != ',') *q++ = *p++;
             *q = 0;
             p++;