[PR] avformat/dashdec: handle range strings without two offsets (PR #23666)

PR #23666 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23666
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23666.patch

Fixes: NULL pointer dereference
Fixes: drRnUHy1N0XR
Fixes: 8db4ef3e6d9377d131e7051dcebf41fa6cc9ac81 (avformat/dashdec.c: Download dash content with byte range info)
Found-by: Pavel Kohout (Aisle Research)
Signed-off-by: Michael Niedermayer <[email protected]>



>From a6d27e2fa16ac2a41b63186285ff8b37d0f6ec2b Mon Sep 17 00:00:00 2001
From: Pavel Kohout <[email protected]>
Date: Tue, 30 Jun 2026 21:56:18 +0200
Subject: [PATCH] avformat/dashdec: handle range strings without two offsets

Fixes: NULL pointer dereference
Fixes: drRnUHy1N0XR
Fixes: 8db4ef3e6d9377d131e7051dcebf41fa6cc9ac81 (avformat/dashdec.c: Download dash content with byte range info)
Found-by: Pavel Kohout (Aisle Research)
Signed-off-by: Michael Niedermayer <[email protected]>
---
 libavformat/dashdec.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c
index 0ffab1e889..38bbaf1d95 100644
--- a/libavformat/dashdec.c
+++ b/libavformat/dashdec.c
@@ -598,8 +598,12 @@ static struct fragment *get_fragment(char *range)
 
     seg->size = -1;
     if (range) {
-        char *str_end_offset;
+        char *str_end_offset = NULL;
         char *str_offset = av_strtok(range, "-", &str_end_offset);
+        if (!str_offset || !str_end_offset) {
+            av_free(seg);
+            return NULL;
+        }
         seg->url_offset = strtoll(str_offset, NULL, 10);
         seg->size = strtoll(str_end_offset, NULL, 10) - seg->url_offset + 1;
     }
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]