CVE-2022-2549

commit 0102c5d4db7fdbf08b5b591b2a6264de33867a07
Author: jeanlf <jeanlf@gpac.io>
Date:   Sun Jul 24 11:30:34 2022 +0200

    fixed #2232

Gbp-Pq: Name CVE-2022-2549.patch

diff --git a/src/scene_manager/scene_dump.c b/src/scene_manager/scene_dump.c
index 6fe250f528d143e6ba438121a82662649d04cdf3..e9bb2e59d09f9cf8289fea5c50116e50e405bdd6 100644 (file)
--- a/src/scene_manager/scene_dump.c
+++ b/src/scene_manager/scene_dump.c
@@ -785,7 +785,7 @@ static void gf_dump_vrml_simple_field(GF_SceneDumper *sdump, GF_FieldInfo field,
                } else {
                        StartAttribute(sdump, "value");
                }
-               for (i=0; i<mffield->count; i++) {
+               for (i=0; mffield && (i<mffield->count); i++) {
                        if (i) gf_fprintf(sdump->trace, " ");
                        gf_sg_vrml_mf_get_item(field.far_ptr, field.fieldType, &slot_ptr, i);
                        /*this is to cope with single MFString which shall appear as SF in XMT*/
@@ -938,12 +938,10 @@ static void gf_dump_vrml_field(GF_SceneDumper *sdump, GF_Node *node, GF_FieldInf
                }
 
                if (!sdump->XMLDump) gf_fprintf(sdump->trace, "[");
-               if (mffield) {
-                       for (i=0; i<mffield->count; i++) {
-                               if (i) gf_fprintf(sdump->trace, " ");
-                               gf_sg_vrml_mf_get_item(field.far_ptr, field.fieldType, &slot_ptr, i);
-                               gf_dump_vrml_sffield(sdump, sf_type, slot_ptr, 1, node);
-                       }
+               for (i=0; mffield && (i<mffield->count); i++) {
+                       if (i) gf_fprintf(sdump->trace, " ");
+                       gf_sg_vrml_mf_get_item(field.far_ptr, field.fieldType, &slot_ptr, i);
+                       gf_dump_vrml_sffield(sdump, sf_type, slot_ptr, 1, node);
                }
                if (!sdump->XMLDump) gf_fprintf(sdump->trace, "]");
 
@@ -1150,7 +1148,7 @@ static void gf_dump_vrml_dyn_field(GF_SceneDumper *sdump, GF_Node *node, GF_Fiel
                                        sdump->indent--;
                                        DUMP_IND(sdump);
                                } else {
-                                       for (i=0; i<mffield->count; i++) {
+                                       for (i=0; mffield && (i<mffield->count); i++) {
                                                if (i) gf_fprintf(sdump->trace, " ");
                                                if (field.fieldType != GF_SG_VRML_MFNODE) {
                                                        gf_sg_vrml_mf_get_item(field.far_ptr, field.fieldType, &slot_ptr, i);
@@ -1191,7 +1189,7 @@ static void gf_dump_vrml_dyn_field(GF_SceneDumper *sdump, GF_Node *node, GF_Fiel
                                        } else {
                                                gf_fprintf(sdump->trace, " %s=\"", GetXMTFieldTypeValueName(field.fieldType));
                                        }
-                                       for (i=0; i<mffield->count; i++) {
+                                       for (i=0; mffield && (i<mffield->count); i++) {
                                                if (i) gf_fprintf(sdump->trace, " ");
                                                if (field.fieldType != GF_SG_VRML_MFNODE) {
                                                        gf_sg_vrml_mf_get_item(field.far_ptr, field.fieldType, &slot_ptr, i);
@@ -1262,13 +1260,11 @@ static void gf_dump_vrml_proto_field(GF_SceneDumper *sdump, GF_Node *node, GF_Fi
                                } else {
                                        gf_fprintf(sdump->trace, " %s=\"", GetXMTFieldTypeValueName(field.fieldType));
                                }
-                               if (mffield) {
-                                       for (i=0; i<mffield->count; i++) {
-                                               if (i) gf_fprintf(sdump->trace, " ");
-                                               if (field.fieldType != GF_SG_VRML_MFNODE) {
-                                                       gf_sg_vrml_mf_get_item(field.far_ptr, field.fieldType, &slot_ptr, i);
-                                                       gf_dump_vrml_sffield(sdump, sf_type, slot_ptr, (mffield->count>1) ? 1 : 0, node);
-                                               }
+                               for (i=0; mffield && (i<mffield->count); i++) {
+                                       if (i) gf_fprintf(sdump->trace, " ");
+                                       if (field.fieldType != GF_SG_VRML_MFNODE) {
+                                               gf_sg_vrml_mf_get_item(field.far_ptr, field.fieldType, &slot_ptr, i);
+                                               gf_dump_vrml_sffield(sdump, sf_type, slot_ptr, (mffield->count>1) ? 1 : 0, node);
                                        }
                                }
                                gf_fprintf(sdump->trace, "\"/>\n");