diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-12-19 20:14:59 +0400 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-12-19 21:36:49 +0400 |
| commit | ae09db1023083cbc99009c9f16e83e159d0ea040 (patch) | |
| tree | c56c4bd5551eb4c9fe7e55bc8fe566f9971e5858 /libavformat/dxa.c | |
| parent | 5a5c1b244281c3edcffca322b0c664ed620b1e24 (diff) | |
avformat/dxa: check avio_read() return
Fixes use of uninitialized memory
Fixes msan_uninit-mem_7fd4d4323ddd_2453_MUSOSP1.dxa
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat/dxa.c')
| -rw-r--r-- | libavformat/dxa.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/libavformat/dxa.c b/libavformat/dxa.c index 22ee2a97a5..5b2d7c0cbe 100644 --- a/libavformat/dxa.c +++ b/libavformat/dxa.c @@ -169,7 +169,10 @@ static int dxa_read_packet(AVFormatContext *s, AVPacket *pkt) } avio_seek(s->pb, c->vidpos, SEEK_SET); while(!url_feof(s->pb) && c->frames){ - avio_read(s->pb, buf, 4); + if ((ret = avio_read(s->pb, buf, 4)) != 4) { + av_log(s, AV_LOG_ERROR, "failed reading chunk type\n"); + return ret < 0 ? ret : AVERROR_INVALIDDATA; + } switch(AV_RL32(buf)){ case MKTAG('N', 'U', 'L', 'L'): if(av_new_packet(pkt, 4 + pal_size) < 0) @@ -187,7 +190,10 @@ static int dxa_read_packet(AVFormatContext *s, AVPacket *pkt) avio_read(s->pb, pal + 4, 768); break; case MKTAG('F', 'R', 'A', 'M'): - avio_read(s->pb, buf + 4, DXA_EXTRA_SIZE - 4); + if ((ret = avio_read(s->pb, buf + 4, DXA_EXTRA_SIZE - 4)) != DXA_EXTRA_SIZE - 4) { + av_log(s, AV_LOG_ERROR, "failed reading dxa_extra\n"); + return ret < 0 ? ret : AVERROR_INVALIDDATA; + } size = AV_RB32(buf + 5); if(size > 0xFFFFFF){ av_log(s, AV_LOG_ERROR, "Frame size is too big: %d\n", size); |