From c9b961748f79f875360d5519963d08f7972bb935 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Fri, 31 Jan 2014 17:21:32 +0100 Subject: [PATCH] avformat/flac_picture: allocate buffer padding for picture Fixes: heap array overread Fixes: asan_heap-oob_14876d9_4706_cov_815472558_cover_art.flac Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer (cherry picked from commit fff2953163ff466d5391b2f862bd2216fbe728b2) Signed-off-by: Michael Niedermayer --- libavformat/flac_picture.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/flac_picture.c b/libavformat/flac_picture.c index 12d73e488f..a58b3055c8 100644 --- a/libavformat/flac_picture.c +++ b/libavformat/flac_picture.c @@ -107,7 +107,7 @@ int ff_flac_parse_picture(AVFormatContext *s, uint8_t *buf, int buf_size) ret = AVERROR_INVALIDDATA; goto fail; } - if (!(data = av_buffer_alloc(len))) { + if (!(data = av_buffer_alloc(len + FF_INPUT_BUFFER_PADDING_SIZE))) { RETURN_ERROR(AVERROR(ENOMEM)); } if (avio_read(pb, data->data, len) != len) {