[FFmpeg-cvslog] libopenmpt: add missing avio_read return value check
Andreas Cadhalpun
git at videolan.org
Thu Jan 26 02:14:36 EET 2017
ffmpeg | branch: release/3.2 | Andreas Cadhalpun <andreas.cadhalpun at googlemail.com> | Sun Jan 1 20:27:50 2017 +0100| [41fc098a8612ba1af98ea0713c929a1f32f3ae87] | committer: Michael Niedermayer
libopenmpt: add missing avio_read return value check
This fixes heap-buffer-overflows in libopenmpt caused by interpreting
the negative size value as unsigned size_t.
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun at googlemail.com>
Reviewed-by: Jörn Heusipp <osmanx at problemloesungsmaschine.de>
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
(cherry picked from commit 367cac7827870054ae3bd6d4517e7b13f4f3f72c)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=41fc098a8612ba1af98ea0713c929a1f32f3ae87
---
libavformat/libopenmpt.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/libavformat/libopenmpt.c b/libavformat/libopenmpt.c
index e7091ef..35fd28f 100644
--- a/libavformat/libopenmpt.c
+++ b/libavformat/libopenmpt.c
@@ -82,6 +82,11 @@ static int read_header_openmpt(AVFormatContext *s)
if (!buf)
return AVERROR(ENOMEM);
size = avio_read(s->pb, buf, size);
+ if (size < 0) {
+ av_log(s, AV_LOG_ERROR, "Reading input buffer failed.\n");
+ av_freep(&buf);
+ return size;
+ }
openmpt->module = openmpt_module_create_from_memory(buf, size, openmpt_logfunc, s, NULL);
av_freep(&buf);
More information about the ffmpeg-cvslog
mailing list