Browse Source

libavformat/amr.c: Check return value from avio_read()

If the buffer doesn't contain enough bytes when reading a stream,
fail rather than continuing on with initialized data. Caught by
Chromium fuzzeras (crbug.com/1065731).

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5b967f56b6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
tags/n2.8.16
John Rummell Michael Niedermayer 5 years ago
parent
commit
1881989f2f
1 changed files with 4 additions and 2 deletions
  1. +4
    -2
      libavformat/amr.c

+ 4
- 2
libavformat/amr.c View File

@@ -83,13 +83,15 @@ static int amr_read_header(AVFormatContext *s)
AVStream *st;
uint8_t header[9];

avio_read(pb, header, 6);
if (avio_read(pb, header, 6) != 6)
return AVERROR_INVALIDDATA;

st = avformat_new_stream(s, NULL);
if (!st)
return AVERROR(ENOMEM);
if (memcmp(header, AMR_header, 6)) {
avio_read(pb, header + 6, 3);
if (avio_read(pb, header + 6, 3) != 3)
return AVERROR_INVALIDDATA;
if (memcmp(header, AMRWB_header, 9)) {
return -1;
}


Loading…
Cancel
Save