From 3cfa310c5de526dbc40d7b33eb6234cff29d8f8c Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Mon, 23 Dec 2013 18:09:58 +0100 Subject: [PATCH] avformat/ape: zero seektable&bittable and warn when they where only partially filled Fixes use of uninitialized memory Fixes: msan_uninit-mem_7fcc198b365b_8417_sh3.ape Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer --- libavformat/ape.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/libavformat/ape.c b/libavformat/ape.c index 6f824800a3..4e6e6bde31 100644 --- a/libavformat/ape.c +++ b/libavformat/ape.c @@ -282,18 +282,20 @@ static int ape_read_header(AVFormatContext * s) ape->totalsamples += ape->blocksperframe * (ape->totalframes - 1); if (ape->seektablelength > 0) { - ape->seektable = av_malloc(ape->seektablelength); + ape->seektable = av_mallocz(ape->seektablelength); if (!ape->seektable) return AVERROR(ENOMEM); for (i = 0; i < ape->seektablelength / sizeof(uint32_t) && !pb->eof_reached; i++) ape->seektable[i] = avio_rl32(pb); if (ape->fileversion < 3810) { - ape->bittable = av_malloc(ape->totalframes); + ape->bittable = av_mallocz(ape->totalframes); if (!ape->bittable) return AVERROR(ENOMEM); for (i = 0; i < ape->totalframes && !pb->eof_reached; i++) ape->bittable[i] = avio_r8(pb); } + if (pb->eof_reached) + av_log(s, AV_LOG_WARNING, "File truncated\n"); } ape->frames[0].pos = ape->firstframe;