sysutils/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-10-24 02:09:03 +03:00
Code Activity

avformat/genh: check thp extradata read and allocation

Browse Source 
the genh demuxer had the same short-read issue at one location. the read is now performed with `ffio_read_size()` so truncated input is rejected instead of leaving uninitialized data in the extradata.
`ff_alloc_extradata()` also had its return value unchecked. if allocation failed, the code could dereference a null pointer. the return value is now checked.
the affected path is capped at two channels, so the potential information leak is relatively small, but it is the same underlying bug class.

Signed-off-by: unfunnyatearug <yalisib2222@gmail.com>
This commit is contained in:
unfunnyatearug
2026-08-18 14:46:35 +03:00
committed by James Almer
parent 29f513af78
commit 4b47405e1c
1 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
libavformat/genh.c
View File

@@ -22,6 +22,7 @@
#include "libavutil/channel_layout.h"
#include "libavutil/intreadwrite.h"
#include "avformat.h"
#include "avio_internal.h"
#include "demux.h"
#include "internal.h"
@@ -132,14 +133,18 @@ static int genh_read_header(AVFormatContext *s)
return AVERROR_PATCHWELCOME;
}
ff_alloc_extradata(st->codecpar, 32 * st->codecpar->ch_layout.nb_channels);
ret = ff_alloc_extradata(st->codecpar, 32 * st->codecpar->ch_layout.nb_channels);
if (ret < 0)
return ret;
for (ch = 0; ch < st->codecpar->ch_layout.nb_channels; ch++) {
if (coef_type & 1) {
avpriv_request_sample(s, "coef_type & 1");
return AVERROR_PATCHWELCOME;
} else {
avio_seek(s->pb, coef[ch], SEEK_SET);
avio_read(s->pb, st->codecpar->extradata + 32 * ch, 32);
ret = ffio_read_size(s->pb, st->codecpar->extradata + 32 * ch, 32);
if (ret < 0)
return ret;
}
}