diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-12-29 13:20:03 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-12-29 13:25:13 +0100 |
| commit | 8a0d446ad618ff89e2e212beb7e6ebee125a85a4 (patch) | |
| tree | 34c9bd588fc06d2d70fc13bb3ca88bec9590542f | |
| parent | f4c62b9f6405f363a74818272e6e51838b55f056 (diff) | |
avformat/siff: check avio_read() return value before returning packet
Fixes: /ld/michael/ffmpeg_uninit/ffmpeg_uninit/done/msan_uninit-mem_7fb3e0fa86e9_1980_INTRO_B.VB
Fixes use of uninitialized memory
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavformat/siff.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/libavformat/siff.c b/libavformat/siff.c index c8b68abe30..8da6c2f67a 100644 --- a/libavformat/siff.c +++ b/libavformat/siff.c @@ -216,7 +216,10 @@ static int siff_read_packet(AVFormatContext *s, AVPacket *pkt) AV_WL16(pkt->data, c->flags); if (c->gmcsize) memcpy(pkt->data + 2, c->gmc, c->gmcsize); - avio_read(s->pb, pkt->data + 2 + c->gmcsize, size); + if (avio_read(s->pb, pkt->data + 2 + c->gmcsize, size) != size) { + av_free_packet(pkt); + return AVERROR_INVALIDDATA; + } pkt->stream_index = 0; c->curstrm = -1; }else{ |