diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-12-23 18:09:58 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-12-25 02:01:46 +0100 |
| commit | 3cfa310c5de526dbc40d7b33eb6234cff29d8f8c (patch) | |
| tree | b0d6c31a84026c3532e19599f2e85fd2a17d5964 /libavformat | |
| parent | f07ca542e371ec137d7192ccecf61ea889c13510 (diff) | |
| download | ffmpeg-3cfa310c5de526dbc40d7b33eb6234cff29d8f8c.tar.gz | |
avformat/ape: zero seektable&bittable and warn when they where only partially filled
Fixes use of uninitialized memory
Fixes: msan_uninit-mem_7fcc198b365b_8417_sh3.ape
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat')
| -rw-r--r-- | libavformat/ape.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/libavformat/ape.c b/libavformat/ape.c index 6f824800a3..4e6e6bde31 100644 --- a/libavformat/ape.c +++ b/libavformat/ape.c @@ -282,18 +282,20 @@ static int ape_read_header(AVFormatContext * s) ape->totalsamples += ape->blocksperframe * (ape->totalframes - 1); if (ape->seektablelength > 0) { - ape->seektable = av_malloc(ape->seektablelength); + ape->seektable = av_mallocz(ape->seektablelength); if (!ape->seektable) return AVERROR(ENOMEM); for (i = 0; i < ape->seektablelength / sizeof(uint32_t) && !pb->eof_reached; i++) ape->seektable[i] = avio_rl32(pb); if (ape->fileversion < 3810) { - ape->bittable = av_malloc(ape->totalframes); + ape->bittable = av_mallocz(ape->totalframes); if (!ape->bittable) return AVERROR(ENOMEM); for (i = 0; i < ape->totalframes && !pb->eof_reached; i++) ape->bittable[i] = avio_r8(pb); } + if (pb->eof_reached) + av_log(s, AV_LOG_WARNING, "File truncated\n"); } ape->frames[0].pos = ape->firstframe; |