backport_1065731.patch 1.1 KB

123456789101112131415161718192021222324252627282930
  1. From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
  2. From: Cheng Zhao <[email protected]>
  3. Date: Thu, 4 Oct 2018 14:57:02 -0700
  4. Subject: fix: check return value from avio_read()
  5. [1065731] [Medium]: audio_decoder_fuzzer: Use-of-uninitialized-value in amr_read_header
  6. Backport https://chromium.googlesource.com/chromium/third_party/ffmpeg.git/+/5b967f56b6d85f62446836fc8ef64d0dcfcbda17
  7. diff --git a/libavformat/amr.c b/libavformat/amr.c
  8. index 42840a50a300ff23d6ddfa56a1410770f0fdbd59..a963eb3ded78671e48d5bc36397c39281f431d21 100644
  9. --- a/libavformat/amr.c
  10. +++ b/libavformat/amr.c
  11. @@ -90,13 +90,15 @@ static int amr_read_header(AVFormatContext *s)
  12. AVStream *st;
  13. uint8_t header[9];
  14. - avio_read(pb, header, 6);
  15. + if (avio_read(pb, header, 6) != 6)
  16. + return AVERROR_INVALIDDATA;
  17. st = avformat_new_stream(s, NULL);
  18. if (!st)
  19. return AVERROR(ENOMEM);
  20. if (memcmp(header, AMR_header, 6)) {
  21. - avio_read(pb, header + 6, 3);
  22. + if (avio_read(pb, header + 6, 3) != 3)
  23. + return AVERROR_INVALIDDATA;
  24. if (memcmp(header, AMRWB_header, 9)) {
  25. return -1;
  26. }