RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avformat/iss: check sscanf() return code 

Fixes use of uninitialized data
Fixes: msan_uninit-mem_7f883205ce82_15_0001010100.iss
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2013-12-23 00:17:52 +01:00
parent 6da21c1f81
commit 5c3079aaa9
1 changed files with 12 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
libavformat/iss.c
View File

@ -76,14 +76,23 @@ static av_cold int iss_read_header(AVFormatContext *s)
get_token(pb, token, sizeof(token)); //"IMA_ADPCM_Sound" get_token(pb, token, sizeof(token)); //"IMA_ADPCM_Sound"
get_token(pb, token, sizeof(token)); //packet size get_token(pb, token, sizeof(token)); //packet size
sscanf(token, "%d", &iss->packet_size); if (sscanf(token, "%d", &iss->packet_size) != 1) {
av_log(s, AV_LOG_ERROR, "Failed parsing packet size\n");
return AVERROR_INVALIDDATA;
}
get_token(pb, token, sizeof(token)); //File ID get_token(pb, token, sizeof(token)); //File ID
get_token(pb, token, sizeof(token)); //out size get_token(pb, token, sizeof(token)); //out size
get_token(pb, token, sizeof(token)); //stereo get_token(pb, token, sizeof(token)); //stereo
sscanf(token, "%d", &stereo); if (sscanf(token, "%d", &stereo) != 1) {
av_log(s, AV_LOG_ERROR, "Failed parsing stereo flag\n");
return AVERROR_INVALIDDATA;
}
get_token(pb, token, sizeof(token)); //Unknown1 get_token(pb, token, sizeof(token)); //Unknown1
get_token(pb, token, sizeof(token)); //RateDivisor get_token(pb, token, sizeof(token)); //RateDivisor
sscanf(token, "%d", &rate_divisor); if (sscanf(token, "%d", &rate_divisor) != 1) {
av_log(s, AV_LOG_ERROR, "Failed parsing rate_divisor\n");
return AVERROR_INVALIDDATA;
}
get_token(pb, token, sizeof(token)); //Unknown2 get_token(pb, token, sizeof(token)); //Unknown2
get_token(pb, token, sizeof(token)); //Version ID get_token(pb, token, sizeof(token)); //Version ID
get_token(pb, token, sizeof(token)); //Size get_token(pb, token, sizeof(token)); //Size