[FFmpeg-cvslog] avutil/log: check that len is within the buffer before reading it

[Michael Niedermayer]

ffmpeg | branch: release/2.1 | Michael Niedermayer <michaelni at gmx.at> | Wed Nov 27 17:04:05 2013 +0100| [dcecca07585fce8716bdf73dab034a05dadb58cb] | committer: Michael Niedermayer

avutil/log: check that len is within the buffer before reading it

Fixes out of array read
Fixes: asan_heap-oob_19d6979_6857_mmw_deadzy.ogg
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
(cherry picked from commit 808c10e728db2d92ccbb0f8b3bcd4a2f4305a2cf)

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=dcecca07585fce8716bdf73dab034a05dadb58cb
---

 libavutil/log.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavutil/log.c b/libavutil/log.c
index fa65b9f..03fb30e 100644
--- a/libavutil/log.c
+++ b/libavutil/log.c
@@ -203,7 +203,7 @@ static void format_line(void *ptr, int level, const char *fmt, va_list vl,
     av_vbprintf(part+2, fmt, vl);
 
     if(*part[0].str || *part[1].str || *part[2].str) {
-        char lastc = part[2].len ? part[2].str[part[2].len - 1] : 0;
+        char lastc = part[2].len && part[2].len <= part[2].size ? part[2].str[part[2].len - 1] : 0;
         *print_prefix = lastc == '\n' || lastc == '\r';
     }
 }