Commit 0e0f6bd4 authored by Michael Niedermayer's avatar Michael Niedermayer

avformat/id3v2: Check avio_read() return code in id3v2_parse()

Fixes use of uninitialized memory
Fixes: msan_uninit-mem_7f5a04a9b50d_7087_mp3__mp3__tooSmallFinal.mp3
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parent 037fc3b0
...@@ -667,7 +667,8 @@ static void id3v2_parse(AVFormatContext *s, int len, uint8_t version, ...@@ -667,7 +667,8 @@ static void id3v2_parse(AVFormatContext *s, int len, uint8_t version,
unsigned long dlen; unsigned long dlen;
if (isv34) { if (isv34) {
avio_read(s->pb, tag, 4); if (avio_read(s->pb, tag, 4) < 0)
break;
tag[4] = 0; tag[4] = 0;
if (version == 3) { if (version == 3) {
tlen = avio_rb32(s->pb); tlen = avio_rb32(s->pb);
...@@ -676,7 +677,8 @@ static void id3v2_parse(AVFormatContext *s, int len, uint8_t version, ...@@ -676,7 +677,8 @@ static void id3v2_parse(AVFormatContext *s, int len, uint8_t version,
tflags = avio_rb16(s->pb); tflags = avio_rb16(s->pb);
tunsync = tflags & ID3v2_FLAG_UNSYNCH; tunsync = tflags & ID3v2_FLAG_UNSYNCH;
} else { } else {
avio_read(s->pb, tag, 3); if (avio_read(s->pb, tag, 3) < 0)
break;
tag[3] = 0; tag[3] = 0;
tlen = avio_rb24(s->pb); tlen = avio_rb24(s->pb);
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment