[vlc-commits] filter_chain: fix out-of-bound array dereference

[Rémi Denis-Courmont]

vlc | branch: master | Rémi Denis-Courmont <remi at remlab.net> | Fri Aug 26 18:26:04 2016 +0300| [b46faf2b4a64c81cc56f2b26e92e8698daaaeca7] | committer: Rémi Denis-Courmont

filter_chain: fix out-of-bound array dereference

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=b46faf2b4a64c81cc56f2b26e92e8698daaaeca7
---

 src/misc/filter_chain.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/misc/filter_chain.c b/src/misc/filter_chain.c
index 3f18f64..eec453b 100644
--- a/src/misc/filter_chain.c
+++ b/src/misc/filter_chain.c
@@ -59,7 +59,7 @@ struct filter_chain_t
     es_format_t fmt_out; /**< Chain current output format */
     unsigned length; /**< Number of filters */
     bool b_allow_fmt_out_change; /**< Can the output format be changed? */
-    char psz_capability[1]; /**< Module capability for all chained filters */
+    char psz_capability[]; /**< Module capability for all chained filters */
 };
 
 /**
@@ -73,7 +73,7 @@ static filter_chain_t *filter_chain_NewInner( const filter_owner_t *callbacks,
     assert( callbacks != NULL && callbacks->sys != NULL );
     assert( cap != NULL );
 
-    filter_chain_t *chain = malloc( sizeof(*chain) + strlen( cap ) );
+    filter_chain_t *chain = malloc( sizeof(*chain) + strlen( cap ) + 1 );
     if( unlikely(chain == NULL) )
         return NULL;