[FFmpeg-devel] [PATCH 2/7] avformat/mxfdec: Check avio_read() success in mxf_decrypt_triplet()

[Tomas Härdin]

mån 2024-09-23 klockan 23:32 +0200 skrev Michael Niedermayer:
> Fixes: Use of uninitialized memory
> Fixes: 71444/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-
> 5448597561212928
> 
> Found-by: continuous fuzzing process
> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
>  libavformat/mxfdec.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
> index 24f4ed1c33d..b232c45f47d 100644
> --- a/libavformat/mxfdec.c
> +++ b/libavformat/mxfdec.c
> @@ -671,7 +671,8 @@ static int mxf_decrypt_triplet(AVFormatContext
> *s, AVPacket *pkt, KLVPacket *klv
>      if (size < 32 || size - 32 < orig_size || (int)orig_size !=
> orig_size)
>          return AVERROR_INVALIDDATA;
>      avio_read(pb, ivec, 16);
> -    avio_read(pb, tmpbuf, 16);
> +    if (avio_read(pb, tmpbuf, 16) != 16)
> +        return AVERROR_INVALIDDATA;

I get the feeling mxfdec has a whole bunch of these..

/Tomas