Commit d477249a47 for ffmpeg

commit d477249a47afce84810dc32d7b68429a8737b798
Author: Kacper Michajłow <kasper93@gmail.com>
Date:   Fri Oct 16 17:27:40 2026 +0200

    avformat/dashdec: fail when the root BaseURL content cannot be read

    xmlNodeGetContent() returns NULL on allocation failure and the result
    was passed to av_strcasecmp().

    Signed-off-by: Kacper Michajłow <kasper93@gmail.com>

diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c
index cf6e2ed98c..5e8efbcc47 100644
--- a/libavformat/dashdec.c
+++ b/libavformat/dashdec.c
@@ -730,6 +730,7 @@ static int resolve_content_path(AVFormatContext *s, const char *url, int *max_ur
     char *baseurl = NULL;
     char *root_url = NULL;
     char *text = NULL;
+    char *tmp = NULL;
     int isRootHttp = 0;
     char token ='/';
     int start =  0;
@@ -775,6 +776,10 @@ static int resolve_content_path(AVFormatContext *s, const char *url, int *max_ur
             continue;
         }
         text = xmlNodeGetContent(node);
+        if (!text) {
+            updated = AVERROR(ENOMEM);
+            goto end;
+        }
         if (ishttp(text)) {
             xmlFree(text);
             break;
@@ -784,15 +789,13 @@ static int resolve_content_path(AVFormatContext *s, const char *url, int *max_ur

     node = baseurl_nodes[rootId];
     baseurl = xmlNodeGetContent(node);
-    if (baseurl) {
-        size_t len = xmlStrlen(baseurl)+2;
-        char *tmp = xmlRealloc(baseurl, len);
-        if (!tmp) {
-            updated = AVERROR(ENOMEM);
-            goto end;
-        }
-        baseurl = tmp;
+    if (baseurl)
+        tmp = xmlRealloc(baseurl, xmlStrlen(baseurl) + 2);
+    if (!tmp) {
+        updated = AVERROR(ENOMEM);
+        goto end;
     }
+    baseurl = tmp;
     root_url = (av_strcasecmp(baseurl, "")) ? baseurl : path;
     if (node) {
         xmlChar *escaped = xmlEncodeSpecialChars(NULL, root_url);