diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-12-15 15:42:53 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-12-15 15:45:44 +0100 |
| commit | 0e0f6bd4a5796f4f668092d7925a31b9b30fedd4 (patch) | |
| tree | 9ef7a3e6469fda8f79ff37bc6b53d1e59e4d7f4e /libavformat/id3v2.c | |
| parent | 037fc3b054b10aee0f11fdbe835e5dffa8e95b37 (diff) | |
| download | ffmpeg-0e0f6bd4a5796f4f668092d7925a31b9b30fedd4.tar.gz | |
avformat/id3v2: Check avio_read() return code in id3v2_parse()
Fixes use of uninitialized memory
Fixes: msan_uninit-mem_7f5a04a9b50d_7087_mp3__mp3__tooSmallFinal.mp3
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat/id3v2.c')
| -rw-r--r-- | libavformat/id3v2.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/libavformat/id3v2.c b/libavformat/id3v2.c index 4bc76a321c..5f5ccb6322 100644 --- a/libavformat/id3v2.c +++ b/libavformat/id3v2.c @@ -667,7 +667,8 @@ static void id3v2_parse(AVFormatContext *s, int len, uint8_t version, unsigned long dlen; if (isv34) { - avio_read(s->pb, tag, 4); + if (avio_read(s->pb, tag, 4) < 0) + break; tag[4] = 0; if (version == 3) { tlen = avio_rb32(s->pb); @@ -676,7 +677,8 @@ static void id3v2_parse(AVFormatContext *s, int len, uint8_t version, tflags = avio_rb16(s->pb); tunsync = tflags & ID3v2_FLAG_UNSYNCH; } else { - avio_read(s->pb, tag, 3); + if (avio_read(s->pb, tag, 3) < 0) + break; tag[3] = 0; tlen = avio_rb24(s->pb); } |