[FFmpeg-devel] [PATCH v3 1/4] avformat/apngdec: Return error for incomplete header

[Michael Niedermayer]

On Sat, Oct 31, 2020 at 03:16:23PM +0100, Andreas Rheinhardt wrote:
> If avio_read() could read anything, it returns the number of bytes read,
> even if it could not read as much as the caller desired.
> apng_read_header() only checked the return value of its avio_read() calls
> for being negative and this meant that it was possible for an incomplete
> header to not be detected. The return value of the last successfull call
> has been returned instead. This commit changes this.
> 
> Fixes: OOM
> Fixes: 26608/clusterfuzz-testcase-minimized-ffmpeg_dem_APNG_fuzzer-4839491644424192
> 
> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt at gmail.com>
> ---
>  libavformat/apngdec.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)

I would have left the fix for the OOM and the 9 byte read seperate
but the patch LGTM, please apply

thx


[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

The educated differ from the uneducated as much as the living from the
dead. -- Aristotle 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20201103/56919f07/attachment.sig>