avutil/log: check that len is within the buffer before reading it

Fixes out of array read
Fixes: asan_heap-oob_19d6979_6857_mmw_deadzy.ogg
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

diff --git a/libavutil/log.c b/libavutil/log.c
index 56ef53b..5923228 100644 (file)
--- a/libavutil/log.c
+++ b/libavutil/log.c
@@ -200,7 +200,7 @@ static void format_line(void *ptr, int level, const char *fmt, va_list vl,
     av_vbprintf(part+2, fmt, vl);
 
     if(*part[0].str || *part[1].str || *part[2].str) {
-        char lastc = part[2].len ? part[2].str[part[2].len - 1] : 0;
+        char lastc = part[2].len && part[2].len <= part[2].size ? part[2].str[part[2].len - 1] : 0;
         *print_prefix = lastc == '\n' || lastc == '\r';
     }
 }