aboutsummaryrefslogtreecommitdiffstats
path: root/libavformat/wavdec.c
diff options
context:
space:
mode:
authorMichael Niedermayer <michael@niedermayer.cc>2021-01-29 23:58:04 +0100
committerMichael Niedermayer <michael@niedermayer.cc>2021-09-09 13:53:29 +0200
commit624afab90a276459b465246c8bba101abb1b7e70 (patch)
tree1508b0aa6ecba3c68ee179aeeecd7594f74e3672 /libavformat/wavdec.c
parentdcd5b364fb8e4f26caa2cd53e7c8df15b13867d1 (diff)
downloadffmpeg-624afab90a276459b465246c8bba101abb1b7e70.tar.gz
avformat/wavdec: Check avio_get_str16le() for failure
Fixes: out of array access Fixes: 29195/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-5037853281222656 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit d7594ee751e621f6c7ef4d4977c4a3ce169ae0af) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavformat/wavdec.c')
-rw-r--r--libavformat/wavdec.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/libavformat/wavdec.c b/libavformat/wavdec.c
index 547ebd306b..a825c0f7c7 100644
--- a/libavformat/wavdec.c
+++ b/libavformat/wavdec.c
@@ -859,6 +859,10 @@ static int w64_read_header(AVFormatContext *s)
return AVERROR(ENOMEM);
ret = avio_get_str16le(pb, chunk_size, value, chunk_size);
+ if (ret < 0) {
+ av_free(value);
+ return ret;
+ }
avio_skip(pb, chunk_size - ret);
av_dict_set(&s->metadata, chunk_key, value, AV_DICT_DONT_STRDUP_VAL);