dilim/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-08-13 17:07:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

avformat/flac_picture: Correct check

Browse Source 
Since af97c9865f,
the return value of avio_read() has been compared against
an uint32_t, so that the int is promoted to uint32_t for
the comparison (on common systems with 32bit ints). The upshot was
that errors returned from avio_read() were ignored, so that
the buffer could be uninitialized on success.

Fix this by using ffio_read_size() instead.

Fixes: MemorySanitizer: use-of-uninitialized-value
Fixes: 443923343/clusterfuzz-testcase-minimized-ffmpeg_dem_FLAC_fuzzer-5458132865449984

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
(cherry picked from commit 4aed9db83c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Andreas Rheinhardt
2025-12-16 20:53:43 +01:00
committed by Michael Niedermayer
parent 2e35c96557
commit 86f30282a0
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
libavformat/flac_picture.c
View File

@@ -23,6 +23,7 @@
#include "libavcodec/bytestream.h"
#include "libavcodec/png.h"
#include "avformat.h"
#include "avio_internal.h"
#include "demux.h"
#include "flac_picture.h"
#include "id3v2.h"
@@ -160,8 +161,9 @@ int ff_flac_parse_picture(AVFormatContext *s, uint8_t **bufp, int buf_size,
// If truncation was detected copy all data from block and
// read missing bytes not included in the block size.
bytestream2_get_bufferu(&g, data->data, left);
if (avio_read(s->pb, data->data + len - trunclen, trunclen) < trunclen)
RETURN_ERROR(AVERROR_INVALIDDATA);
ret = ffio_read_size(s->pb, data->data + len - trunclen, trunclen);
if (ret < 0)
goto fail;
}
}
memset(data->data + len, 0, AV_INPUT_BUFFER_PADDING_SIZE);