summaryrefslogtreecommitdiff
path: root/libavformat/ape.c
diff options
context:
space:
mode:
authorMichael Niedermayer <michaelni@gmx.at>2013-12-23 18:09:58 +0100
committerMichael Niedermayer <michaelni@gmx.at>2013-12-25 02:01:46 +0100
commit3cfa310c5de526dbc40d7b33eb6234cff29d8f8c (patch)
treeb0d6c31a84026c3532e19599f2e85fd2a17d5964 /libavformat/ape.c
parentf07ca542e371ec137d7192ccecf61ea889c13510 (diff)
avformat/ape: zero seektable&bittable and warn when they where only partially filled
Fixes use of uninitialized memory Fixes: msan_uninit-mem_7fcc198b365b_8417_sh3.ape Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat/ape.c')
-rw-r--r--libavformat/ape.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/libavformat/ape.c b/libavformat/ape.c
index 6f824800a3..4e6e6bde31 100644
--- a/libavformat/ape.c
+++ b/libavformat/ape.c
@@ -282,18 +282,20 @@ static int ape_read_header(AVFormatContext * s)
ape->totalsamples += ape->blocksperframe * (ape->totalframes - 1);
if (ape->seektablelength > 0) {
- ape->seektable = av_malloc(ape->seektablelength);
+ ape->seektable = av_mallocz(ape->seektablelength);
if (!ape->seektable)
return AVERROR(ENOMEM);
for (i = 0; i < ape->seektablelength / sizeof(uint32_t) && !pb->eof_reached; i++)
ape->seektable[i] = avio_rl32(pb);
if (ape->fileversion < 3810) {
- ape->bittable = av_malloc(ape->totalframes);
+ ape->bittable = av_mallocz(ape->totalframes);
if (!ape->bittable)
return AVERROR(ENOMEM);
for (i = 0; i < ape->totalframes && !pb->eof_reached; i++)
ape->bittable[i] = avio_r8(pb);
}
+ if (pb->eof_reached)
+ av_log(s, AV_LOG_WARNING, "File truncated\n");
}
ape->frames[0].pos = ape->firstframe;