Commit 3cfa310c authored by Michael Niedermayer's avatar Michael Niedermayer

avformat/ape: zero seektable&bittable and warn when they where only partially filled

Fixes use of uninitialized memory
Fixes: msan_uninit-mem_7fcc198b365b_8417_sh3.ape
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parent f07ca542
...@@ -282,18 +282,20 @@ static int ape_read_header(AVFormatContext * s) ...@@ -282,18 +282,20 @@ static int ape_read_header(AVFormatContext * s)
ape->totalsamples += ape->blocksperframe * (ape->totalframes - 1); ape->totalsamples += ape->blocksperframe * (ape->totalframes - 1);
if (ape->seektablelength > 0) { if (ape->seektablelength > 0) {
ape->seektable = av_malloc(ape->seektablelength); ape->seektable = av_mallocz(ape->seektablelength);
if (!ape->seektable) if (!ape->seektable)
return AVERROR(ENOMEM); return AVERROR(ENOMEM);
for (i = 0; i < ape->seektablelength / sizeof(uint32_t) && !pb->eof_reached; i++) for (i = 0; i < ape->seektablelength / sizeof(uint32_t) && !pb->eof_reached; i++)
ape->seektable[i] = avio_rl32(pb); ape->seektable[i] = avio_rl32(pb);
if (ape->fileversion < 3810) { if (ape->fileversion < 3810) {
ape->bittable = av_malloc(ape->totalframes); ape->bittable = av_mallocz(ape->totalframes);
if (!ape->bittable) if (!ape->bittable)
return AVERROR(ENOMEM); return AVERROR(ENOMEM);
for (i = 0; i < ape->totalframes && !pb->eof_reached; i++) for (i = 0; i < ape->totalframes && !pb->eof_reached; i++)
ape->bittable[i] = avio_r8(pb); ape->bittable[i] = avio_r8(pb);
} }
if (pb->eof_reached)
av_log(s, AV_LOG_WARNING, "File truncated\n");
} }
ape->frames[0].pos = ape->firstframe; ape->frames[0].pos = ape->firstframe;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment