continue;
else if (state == new_set && !strncmp(p, "id=", 3)) {
void *mem = av_realloc(w->as, sizeof(*w->as) * (w->nb_as + 1));
+ const char *comma;
if (mem == NULL)
return AVERROR(ENOMEM);
w->as = mem;
w->as[w->nb_as - 1].streams = NULL;
p += 3; // consume "id="
q = w->as[w->nb_as - 1].id;
+ comma = strchr(p, ',');
+ if (!comma || comma - p >= sizeof(w->as[w->nb_as - 1].id)) {
+ av_log(s, AV_LOG_ERROR, "'id' in 'adaptation_sets' is malformed.\n");
+ return AVERROR(EINVAL);
+ }
while (*p != ',') *q++ = *p++;
*q = 0;
p++;