sysutils/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-10-24 02:09:03 +03:00
Code Activity

avformat/fsb: reject truncated thp coefficient extradata

Browse Source 
the fsb demuxer used `avio_read(..., 32)` for each channel but ignored the return value.
`ff_alloc_extradata()` only clears the padding area. if the input file is truncated, the remaining extradata can therefore contain uninitialized memory.
`nb_channels` is a 16-bit value and was only limited by the `int_max / 32` calculation. this allows a truncated file to cause a leak of up to ~2 MB of uninitialized memory.
the affected extradata is used by the `adpcm_thp` decoder and can also be copied to the output during remuxing.
the fix replaces the unchecked reads with `ffio_read_size()`, which reports an error when the requested amount of data cannot be read. both the thp v3 and v4 paths are fixed.

Signed-off-by: unfunnyatearug <yalisib2222@gmail.com>
This commit is contained in:
unfunnyatearug
2026-08-18 14:46:35 +03:00
committed by James Almer
parent 712a8f9e84
commit 29f513af78
1 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
libavformat/fsb.c
View File

@@ -23,6 +23,7 @@
#include "libavutil/intreadwrite.h"
#include "avformat.h"
#include "avio.h"
#include "avio_internal.h"
#include "demux.h"
#include "internal.h"
@@ -93,7 +94,9 @@ static int fsb_read_header(AVFormatContext *s)
return ret;
avio_seek(pb, 0x68, SEEK_SET);
for (c = 0; c < par->ch_layout.nb_channels; c++) {
avio_read(pb, par->extradata + 32 * c, 32);
ret = ffio_read_size(pb, par->extradata + 32 * c, 32);
if (ret < 0)
return ret;
avio_skip(pb, 14);
}
} else {
@@ -146,7 +149,9 @@ static int fsb_read_header(AVFormatContext *s)
return ret;
avio_seek(pb, 0x80, SEEK_SET);
for (c = 0; c < par->ch_layout.nb_channels; c++) {
avio_read(pb, par->extradata + 32 * c, 32);
ret = ffio_read_size(pb, par->extradata + 32 * c, 32);
if (ret < 0)
return ret;
avio_skip(pb, 14);
}
par->block_align = 8 * par->ch_layout.nb_channels;