diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-12-19 20:48:51 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-12-20 01:03:19 +0100 |
| commit | a165964f3c4b48041b8f053813761490d57c6222 (patch) | |
| tree | dc7d1560615d423776aacb89ff7dfe22e27484f8 | |
| parent | 200cfab8c4c21a0494470441bf0e4528f0df41d6 (diff) | |
| download | ffmpeg-a165964f3c4b48041b8f053813761490d57c6222.tar.gz | |
avformat/sierravmd: Check avio_read return value
Fixes use of uninitialized memory
Fixes: msan_uninit-mem_7f82af392dae_1848_HR060606.VMD
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavformat/sierravmd.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/libavformat/sierravmd.c b/libavformat/sierravmd.c index 8749ec1640..9bd42b4e78 100644 --- a/libavformat/sierravmd.c +++ b/libavformat/sierravmd.c @@ -204,7 +204,12 @@ static int vmd_read_header(AVFormatContext *s) int type; uint32_t size; - avio_read(pb, chunk, BYTES_PER_FRAME_RECORD); + if ((ret = avio_read(pb, chunk, BYTES_PER_FRAME_RECORD)) != BYTES_PER_FRAME_RECORD) { + av_log(s, AV_LOG_ERROR, "Failed to read frame record\n"); + if (ret >= 0) + ret = AVERROR_INVALIDDATA; + goto error; + } type = chunk[0]; size = AV_RL32(&chunk[2]); if (size > INT_MAX / 2) { |