Commit 5b967f56 authored by John Rummell's avatar John Rummell Committed by Michael Niedermayer

libavformat/amr.c: Check return value from avio_read()

If the buffer doesn't contain enough bytes when reading a stream,
fail rather than continuing on with initialized data. Caught by
Chromium fuzzeras (crbug.com/1065731).
Signed-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
parent 4700f7d6
......@@ -89,13 +89,15 @@ static int amr_read_header(AVFormatContext *s)
AVStream *st;
uint8_t header[9];
avio_read(pb, header, 6);
if (avio_read(pb, header, 6) != 6)
return AVERROR_INVALIDDATA;
st = avformat_new_stream(s, NULL);
if (!st)
return AVERROR(ENOMEM);
if (memcmp(header, AMR_header, 6)) {
avio_read(pb, header + 6, 3);
if (avio_read(pb, header + 6, 3) != 3)
return AVERROR_INVALIDDATA;
if (memcmp(header, AMRWB_header, 9)) {
return -1;
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment