RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

libavformat/amr.c: Check return value from avio_read() 

If the buffer doesn't contain enough bytes when reading a stream,
fail rather than continuing on with initialized data. Caught by
Chromium fuzzeras (crbug.com/1065731).

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5b967f56b6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
John Rummell 2020-03-30 21:30:33 -07:00 committed by Michael Niedermayer
parent 8c73f80276
commit 83b2cc152d
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libavformat/amr.c
View File

@ -90,13 +90,15 @@ static int amr_read_header(AVFormatContext *s)
AVStream *st; AVStream *st;
uint8_t header[9]; uint8_t header[9];
avio_read(pb, header, 6); if (avio_read(pb, header, 6) != 6)
return AVERROR_INVALIDDATA;
st = avformat_new_stream(s, NULL); st = avformat_new_stream(s, NULL);
if (!st) if (!st)
return AVERROR(ENOMEM); return AVERROR(ENOMEM);
if (memcmp(header, AMR_header, 6)) { if (memcmp(header, AMR_header, 6)) {
avio_read(pb, header + 6, 3); if (avio_read(pb, header + 6, 3) != 3)
return AVERROR_INVALIDDATA;
if (memcmp(header, AMRWB_header, 9)) { if (memcmp(header, AMRWB_header, 9)) {
return -1; return -1;
} }