From 0b79a389ba488d50fd9947554d803fc51b877bb3 Mon Sep 17 00:00:00 2001 From: Andreas Cadhalpun Date: Fri, 22 May 2015 22:58:55 +0200 Subject: nutdec: always check the get_str return value If it fails, the buffers can be (partially) uninitialized. This fixes 'Conditional jump or move depends on uninitialised value(s)' valgrind warnings. Reviewed-by: Michael Niedermayer Signed-off-by: Andreas Cadhalpun --- libavformat/nutdec.c | 27 ++++++++++++++++++++++----- 1 file changed, 22 insertions(+), 5 deletions(-) diff --git a/libavformat/nutdec.c b/libavformat/nutdec.c index ad9053cf73..eeaf8bf9ae 100644 --- a/libavformat/nutdec.c +++ b/libavformat/nutdec.c @@ -544,11 +544,15 @@ static int decode_info_header(NUTContext *nut) if (value == -1) { type = "UTF-8"; - get_str(bc, str_value, sizeof(str_value)); + ret = get_str(bc, str_value, sizeof(str_value)); } else if (value == -2) { - get_str(bc, type_str, sizeof(type_str)); + ret = get_str(bc, type_str, sizeof(type_str)); + if (ret < 0) { + av_log(s, AV_LOG_ERROR, "get_str failed while decoding info header\n"); + return ret; + } type = type_str; - get_str(bc, str_value, sizeof(str_value)); + ret = get_str(bc, str_value, sizeof(str_value)); } else if (value == -3) { type = "s"; value = get_s(bc); @@ -562,6 +566,11 @@ static int decode_info_header(NUTContext *nut) type = "v"; } + if (ret < 0) { + av_log(s, AV_LOG_ERROR, "get_str failed while decoding info header\n"); + return ret; + } + if (stream_id_plus1 > s->nb_streams) { av_log(s, AV_LOG_ERROR, "invalid stream id for info packet\n"); continue; @@ -875,13 +884,21 @@ static int read_sm_data(AVFormatContext *s, AVIOContext *bc, AVPacket *pkt, int value = get_s(bc); if (value == -1) { - get_str(bc, str_value, sizeof(str_value)); + ret = get_str(bc, str_value, sizeof(str_value)); + if (ret < 0) { + av_log(s, AV_LOG_ERROR, "get_str failed while reading sm data\n"); + return ret; + } av_log(s, AV_LOG_WARNING, "Unknown string %s / %s\n", name, str_value); } else if (value == -2) { uint8_t *dst = NULL; int64_t v64, value_len; - get_str(bc, type_str, sizeof(type_str)); + ret = get_str(bc, type_str, sizeof(type_str)); + if (ret < 0) { + av_log(s, AV_LOG_ERROR, "get_str failed while reading sm data\n"); + return ret; + } value_len = ffio_read_varlen(bc); if (avio_tell(bc) + value_len >= maxpos) return AVERROR_INVALIDDATA; -- cgit v1.2.3