RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

lafv/wavdec: Fail bext parsing on incomplete reads 

avio_read can successfully return even when less than the requested
amount of input was read. wavdec's bext parsing mistakenly assumed a
successful avio_read always read the full amount that was requested.
The result could be dictionary tags populated with partially
uninitialized values.

This change also fixes a broken assertion in wav_parse_bext_string that
was off-by-one, though no known current usage of that method hits that
broken case.

Chromium bug: 987270

Signed-off-by: Matt Wolenetz <wolenetz@chromium.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 052d41377a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Matt Wolenetz 2019-07-25 15:54:49 -07:00 committed by Michael Niedermayer
parent 9cb0da0bfe
commit 907027a4f2
1 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
libavformat/wavdec.c
View File

@ -233,9 +233,9 @@ static inline int wav_parse_bext_string(AVFormatContext *s, const char *key,
char temp[257];
int ret;
av_assert0(length <= sizeof(temp));
if ((ret = avio_read(s->pb, temp, length)) < 0)
return ret;
av_assert0(length < sizeof(temp));
if ((ret = avio_read(s->pb, temp, length)) != length)
return ret < 0 ? ret : AVERROR_INVALIDDATA;
temp[length] = 0;
@ -304,8 +304,10 @@ static int wav_parse_bext_tag(AVFormatContext *s, int64_t size)
if (!(coding_history = av_malloc(size + 1)))
return AVERROR(ENOMEM);
if ((ret = avio_read(s->pb, coding_history, size)) < 0)
return ret;
if ((ret = avio_read(s->pb, coding_history, size)) != size) {
av_free(coding_history);
return ret < 0 ? ret : AVERROR_INVALIDDATA;
}
coding_history[size] = 0;
if ((ret = av_dict_set(&s->metadata, "coding_history", coding_history,