[FFmpeg-cvslog] avformat/ape: zero seektable&bittable and warn when they where only partially filled

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Mon Dec 23 18:09:58 2013 +0100| [3cfa310c5de526dbc40d7b33eb6234cff29d8f8c] | committer: Michael Niedermayer

avformat/ape: zero seektable&bittable and warn when they where only partially filled

Fixes use of uninitialized memory
Fixes: msan_uninit-mem_7fcc198b365b_8417_sh3.ape
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3cfa310c5de526dbc40d7b33eb6234cff29d8f8c
---

 libavformat/ape.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/libavformat/ape.c b/libavformat/ape.c
index 6f82480..4e6e6bd 100644
--- a/libavformat/ape.c
+++ b/libavformat/ape.c
@@ -282,18 +282,20 @@ static int ape_read_header(AVFormatContext * s)
         ape->totalsamples += ape->blocksperframe * (ape->totalframes - 1);
 
     if (ape->seektablelength > 0) {
-        ape->seektable = av_malloc(ape->seektablelength);
+        ape->seektable = av_mallocz(ape->seektablelength);
         if (!ape->seektable)
             return AVERROR(ENOMEM);
         for (i = 0; i < ape->seektablelength / sizeof(uint32_t) && !pb->eof_reached; i++)
             ape->seektable[i] = avio_rl32(pb);
         if (ape->fileversion < 3810) {
-            ape->bittable = av_malloc(ape->totalframes);
+            ape->bittable = av_mallocz(ape->totalframes);
             if (!ape->bittable)
                 return AVERROR(ENOMEM);
             for (i = 0; i < ape->totalframes && !pb->eof_reached; i++)
                 ape->bittable[i] = avio_r8(pb);
         }
+        if (pb->eof_reached)
+            av_log(s, AV_LOG_WARNING, "File truncated\n");
     }
 
     ape->frames[0].pos     = ape->firstframe;