From 29f513af7833499ddff3f2443609356eacfdd665 Mon Sep 17 00:00:00 2001 From: unfunnyatearug Date: Tue, 18 Aug 2026 14:46:35 +0300 Subject: [PATCH] avformat/fsb: reject truncated thp coefficient extradata the fsb demuxer used `avio_read(..., 32)` for each channel but ignored the return value. `ff_alloc_extradata()` only clears the padding area. if the input file is truncated, the remaining extradata can therefore contain uninitialized memory. `nb_channels` is a 16-bit value and was only limited by the `int_max / 32` calculation. this allows a truncated file to cause a leak of up to ~2 MB of uninitialized memory. the affected extradata is used by the `adpcm_thp` decoder and can also be copied to the output during remuxing. the fix replaces the unchecked reads with `ffio_read_size()`, which reports an error when the requested amount of data cannot be read. both the thp v3 and v4 paths are fixed. Signed-off-by: unfunnyatearug --- libavformat/fsb.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/libavformat/fsb.c b/libavformat/fsb.c index 0febeffd56..1164f48b94 100644 --- a/libavformat/fsb.c +++ b/libavformat/fsb.c @@ -23,6 +23,7 @@ #include "libavutil/intreadwrite.h" #include "avformat.h" #include "avio.h" +#include "avio_internal.h" #include "demux.h" #include "internal.h" @@ -93,7 +94,9 @@ static int fsb_read_header(AVFormatContext *s) return ret; avio_seek(pb, 0x68, SEEK_SET); for (c = 0; c < par->ch_layout.nb_channels; c++) { - avio_read(pb, par->extradata + 32 * c, 32); + ret = ffio_read_size(pb, par->extradata + 32 * c, 32); + if (ret < 0) + return ret; avio_skip(pb, 14); } } else { @@ -146,7 +149,9 @@ static int fsb_read_header(AVFormatContext *s) return ret; avio_seek(pb, 0x80, SEEK_SET); for (c = 0; c < par->ch_layout.nb_channels; c++) { - avio_read(pb, par->extradata + 32 * c, 32); + ret = ffio_read_size(pb, par->extradata + 32 * c, 32); + if (ret < 0) + return ret; avio_skip(pb, 14); } par->block_align = 8 * par->ch_layout.nb_channels;