diff options
| author | Dr.Smile <vabnick@gmail.com> | 2021-02-24 01:53:54 +0300 |
|---|---|---|
| committer | Dr.Smile <vabnick@gmail.com> | 2021-02-24 01:53:54 +0300 |
| commit | 8f987713dd0fa791c5c511c13bb27021fa653fb0 (patch) | |
| tree | aab1383bd7ae3f178157df505f8ec40cb7920706 | |
| parent | a93e17f5ffe526e68c88d69141dbf495523376e2 (diff) | |
| download | libass-8f987713dd0fa791c5c511c13bb27021fa653fb0.tar.bz2 libass-8f987713dd0fa791c5c511c13bb27021fa653fb0.tar.xz | |
Fix crash on empty strings
Our hash function doesn't handle zero-length buffers,
but it was not a problem until 82b225b3d6653091d028b39d561d185ed76a7be5.
Found by OSS-Fuzz.
| -rw-r--r-- | libass/ass_utils.h | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/libass/ass_utils.h b/libass/ass_utils.h index 3f65b87..0379df6 100644 --- a/libass/ass_utils.h +++ b/libass/ass_utils.h @@ -185,6 +185,9 @@ static inline int double_to_d22(double x) static inline uint32_t fnv_32a_buf(const void *buf, size_t len, uint32_t hval) { + if (!len) + return hval; + const uint8_t *bp = buf; size_t n = (len + 3) / 4; |