[FFmpeg-cvslog] avformat/id3v2: Check avio_read() return code in id3v2_parse()

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Sun Dec 15 15:42:53 2013 +0100| [0e0f6bd4a5796f4f668092d7925a31b9b30fedd4] | committer: Michael Niedermayer

avformat/id3v2: Check avio_read() return code in id3v2_parse()

Fixes use of uninitialized memory
Fixes: msan_uninit-mem_7f5a04a9b50d_7087_mp3__mp3__tooSmallFinal.mp3
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0e0f6bd4a5796f4f668092d7925a31b9b30fedd4
---

 libavformat/id3v2.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/libavformat/id3v2.c b/libavformat/id3v2.c
index 4bc76a3..5f5ccb6 100644
--- a/libavformat/id3v2.c
+++ b/libavformat/id3v2.c
@@ -667,7 +667,8 @@ static void id3v2_parse(AVFormatContext *s, int len, uint8_t version,
         unsigned long dlen;
 
         if (isv34) {
-            avio_read(s->pb, tag, 4);
+            if (avio_read(s->pb, tag, 4) < 0)
+                break;
             tag[4] = 0;
             if (version == 3) {
                 tlen = avio_rb32(s->pb);
@@ -676,7 +677,8 @@ static void id3v2_parse(AVFormatContext *s, int len, uint8_t version,
             tflags  = avio_rb16(s->pb);
             tunsync = tflags & ID3v2_FLAG_UNSYNCH;
         } else {
-            avio_read(s->pb, tag, 3);
+            if (avio_read(s->pb, tag, 3) < 0)
+                break;
             tag[3] = 0;
             tlen   = avio_rb24(s->pb);
         }