avformat/binka: reject truncated packet reads

binka_read_packet() calls avio_read() into a buffer from av_new_packet()
and ignores the return value. packet_alloc() only zeroes the 64-byte
padding; the payload is left uninitialized.

pkt_size is avio_rl16() + 4 (max 65539). On a truncated file the demuxer
still returns 0, so av_read_frame delivers up to 64 KiB of uninitialized
heap per packet. ffmpeg -c copy writes those bytes into the output.

Use ffio_read_size() so a short read fails the packet with
AVERROR_INVALIDDATA. Same class as 29f513a (fsb) and 4b47405 (genh).

Signed-off-by: Paulo Cabral Sanz <paulosanz@poli.ufrj.br>

libavformat/binka.c

@@ -20,6 +20,7 @@
 
 #include "libavutil/intreadwrite.h"
 #include "avformat.h"
+#include "avio_internal.h"
 #include "demux.h"
 #include "internal.h"
 
@@ -80,7 +81,9 @@ static int binka_read_packet(AVFormatContext *s, AVPacket *pkt)
     if (ret < 0)
         return ret;
 
-    avio_read(pb, pkt->data + 4, pkt_size - 4);
+    ret = ffio_read_size(pb, pkt->data + 4, pkt_size - 4);
+    if (ret < 0)
+        return ret;
     AV_WL32(pkt->data, pkt_size);
 
     pkt->pos = pos;