[FFmpeg-devel] [PATCH 1/4] avformat/vqf: Check avio_read() in add_metadata()

Marton Balint cus at passwd.hu
Thu Dec 26 12:39:10 EET 2024


On Thu, 26 Dec 2024, Michael Niedermayer wrote:

> Fixes: use of uninitialized data
> Fixes: 383825642/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5380168801124352
>
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
> libavformat/vqf.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/libavformat/vqf.c b/libavformat/vqf.c
> index 4820e0817c3..79deb33744b 100644
> --- a/libavformat/vqf.c
> +++ b/libavformat/vqf.c
> @@ -63,7 +63,8 @@ static void add_metadata(AVFormatContext *s, uint32_t tag,
>     buf = av_malloc(len+1);
>     if (!buf)
>         return;
> -    avio_read(s->pb, buf, len);
> +    if (len != avio_read(s->pb, buf, len))
> +        return;

You should propagate error codes.

Thanks,
Marton

>     buf[len] = 0;
>     AV_WL32(key, tag);
>     av_dict_set(&s->metadata, key, buf, AV_DICT_DONT_STRDUP_VAL);
> -- 
> 2.47.0
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel at ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request at ffmpeg.org with subject "unsubscribe".
>


More information about the ffmpeg-devel mailing list