virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-10-30 23:18:11 +02:00
Code Issues Releases Activity

avformat/ape: zero seektable&bittable and warn when they where only partially filled

Browse Source 
Fixes use of uninitialized memory
Fixes: msan_uninit-mem_7fcc198b365b_8417_sh3.ape
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer
2013-12-23 18:09:58 +01:00
parent f07ca542e3
commit 3cfa310c5d
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
libavformat/ape.c
View File

@@ -282,18 +282,20 @@ static int ape_read_header(AVFormatContext * s)
ape->totalsamples += ape->blocksperframe * (ape->totalframes - 1); ape->totalsamples += ape->blocksperframe * (ape->totalframes - 1);
if (ape->seektablelength > 0) { if (ape->seektablelength > 0) {
ape->seektable = av_malloc(ape->seektablelength); ape->seektable = av_mallocz(ape->seektablelength);
if (!ape->seektable) if (!ape->seektable)
return AVERROR(ENOMEM); return AVERROR(ENOMEM);
for (i = 0; i < ape->seektablelength / sizeof(uint32_t) && !pb->eof_reached; i++) for (i = 0; i < ape->seektablelength / sizeof(uint32_t) && !pb->eof_reached; i++)
ape->seektable[i] = avio_rl32(pb); ape->seektable[i] = avio_rl32(pb);
if (ape->fileversion < 3810) { if (ape->fileversion < 3810) {
ape->bittable = av_malloc(ape->totalframes); ape->bittable = av_mallocz(ape->totalframes);
if (!ape->bittable) if (!ape->bittable)
return AVERROR(ENOMEM); return AVERROR(ENOMEM);
for (i = 0; i < ape->totalframes && !pb->eof_reached; i++) for (i = 0; i < ape->totalframes && !pb->eof_reached; i++)
ape->bittable[i] = avio_r8(pb); ape->bittable[i] = avio_r8(pb);
} }
if (pb->eof_reached)
av_log(s, AV_LOG_WARNING, "File truncated\n");
} }
ape->frames[0].pos = ape->firstframe; ape->frames[0].pos = ape->firstframe;