From 8a0d446ad618ff89e2e212beb7e6ebee125a85a4 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 29 Dec 2013 13:20:03 +0100 Subject: [PATCH] avformat/siff: check avio_read() return value before returning packet Fixes: /ld/michael/ffmpeg_uninit/ffmpeg_uninit/done/msan_uninit-mem_7fb3e0fa86e9_1980_INTRO_B.VB Fixes use of uninitialized memory Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer --- libavformat/siff.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libavformat/siff.c b/libavformat/siff.c index c8b68abe30..8da6c2f67a 100644 --- a/libavformat/siff.c +++ b/libavformat/siff.c @@ -216,7 +216,10 @@ static int siff_read_packet(AVFormatContext *s, AVPacket *pkt) AV_WL16(pkt->data, c->flags); if (c->gmcsize) memcpy(pkt->data + 2, c->gmc, c->gmcsize); - avio_read(s->pb, pkt->data + 2 + c->gmcsize, size); + if (avio_read(s->pb, pkt->data + 2 + c->gmcsize, size) != size) { + av_free_packet(pkt); + return AVERROR_INVALIDDATA; + } pkt->stream_index = 0; c->curstrm = -1; }else{