added safety null-termination byte in decomressed payload

gpac · Dec 14, 2023 · bbf2521 · bbf2521
1 parent 804b5b2
commit bbf2521
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 3 deletions.
diff --git a/include/gpac/tools.h b/include/gpac/tools.h
@@ -1977,7 +1977,7 @@ GF_Err gf_gz_compress_payload_ex(u8 **data, u32 data_len, u32 *out_size, u8 data
 Decompresses a data buffer using zlib/inflate.
 \param data data buffer to be decompressed
 \param data_len length of the data buffer to be decompressed
-\param uncompressed_data pointer to the uncompressed data buffer. It is the responsibility of the caller to free this buffer.
+\param uncompressed_data pointer to the uncompressed data buffer. The resulting buffer is NULL-terminated. It is the responsibility of the caller to free this buffer.
 \param out_size size of the uncompressed buffer
 \return error if any
  */
@@ -1987,7 +1987,7 @@ GF_Err gf_gz_decompress_payload(u8 *data, u32 data_len, u8 **uncompressed_data,
 Decompresses a data buffer using zlib/inflate.
 \param data data buffer to be decompressed
 \param data_len length of the data buffer to be decompressed
-\param uncompressed_data pointer to the uncompressed data buffer. It is the responsibility of the caller to free this buffer.
+\param uncompressed_data pointer to the uncompressed data buffer. The resulting buffer is NULL-terminated. It is the responsibility of the caller to free this buffer.
 \param out_size size of the uncompressed buffer
 \param use_gz if true, gz header is present
 \return error if any

diff --git a/src/utils/base_encoding.c b/src/utils/base_encoding.c
@@ -289,13 +289,15 @@ GF_Err gf_gz_decompress_payload_ex(u8 *data, u32 data_len, u8 **uncompressed_dat
 			if (err==Z_STREAM_END) break;
 
 			size *= 2;
-			*uncompressed_data = (char*)gf_realloc(*uncompressed_data, sizeof(char)*size);
+			*uncompressed_data = (char*)gf_realloc(*uncompressed_data, sizeof(char)*(size+1));
 			if (!*uncompressed_data) return GF_OUT_OF_MEM;
 			d_stream.avail_out = (u32) (size - d_stream.total_out);
 			d_stream.next_out = (Bytef*) ( *uncompressed_data + d_stream.total_out);
 		}
 		*out_size = (u32) d_stream.total_out;
 		inflateEnd(&d_stream);
+		//force last byte to 0
+		(*uncompressed_data)[*out_size] = 0;
 	}
 	if (e!=GF_OK) {
 		if (owns_buffer) {