diff options
| author | chcunningham <chcunningham@chromium.org> | 2018-12-14 13:44:07 -0800 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2019-01-15 00:57:27 +0100 |
| commit | 490a5253ca898bc6c9d58571cd2c8bed7f053a68 (patch) | |
| tree | 61ecde094ed6c00016aafc2a7c83873ad19c0f5b | |
| parent | 9925adcd68471459aa60d6a3e2895cec5f2be85b (diff) | |
| download | ffmpeg-490a5253ca898bc6c9d58571cd2c8bed7f053a68.tar.gz | |
lavf/id3v2: fail read_apic on EOF reading mimetype
avio_read may return EOF, leaving the mimetype array unitialized. fail
early when this occurs to avoid using the array in an unitialized state.
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ee1e39a576977fd38c3b94fc56125d31d38833e9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/id3v2.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/libavformat/id3v2.c b/libavformat/id3v2.c index 85a31f77f2..afed5b0468 100644 --- a/libavformat/id3v2.c +++ b/libavformat/id3v2.c @@ -589,7 +589,7 @@ static void read_apic(AVFormatContext *s, AVIOContext *pb, int taglen, int isv34) { int enc, pic_type; - char mimetype[64]; + char mimetype[64] = {0}; const CodecMime *mime = ff_id3v2_mime_tags; enum AVCodecID id = AV_CODEC_ID_NONE; ID3v2ExtraMetaAPIC *apic = NULL; @@ -611,7 +611,9 @@ static void read_apic(AVFormatContext *s, AVIOContext *pb, int taglen, if (isv34) { taglen -= avio_get_str(pb, taglen, mimetype, sizeof(mimetype)); } else { - avio_read(pb, mimetype, 3); + if (avio_read(pb, mimetype, 3) < 0) + goto fail; + mimetype[3] = 0; taglen -= 3; } |