From 54ff4bdbf47fea6ca94671bde0bf48ec6831aacb Mon Sep 17 00:00:00 2001 From: Weidong Wang Date: Sat, 14 Mar 2026 13:18:41 -0500 Subject: [PATCH] avformat/rsd: reject short ADPCM_THP extradata reads Use ffio_read_size() to enforce exact-length reads of the per-channel ADPCM_THP coefficient tables. Previously the return value of avio_read() was unchecked, silently accepting truncated extradata. (cherry picked from commit 06d19d000d8e659e09490bfbcceaa6bb23fb2edb) Signed-off-by: Michael Niedermayer --- libavformat/rsd.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/libavformat/rsd.c b/libavformat/rsd.c index b9098646f6..8eb9f901e1 100644 --- a/libavformat/rsd.c +++ b/libavformat/rsd.c @@ -22,6 +22,7 @@ #include "libavutil/intreadwrite.h" #include "avformat.h" #include "avio.h" +#include "avio_internal.h" #include "demux.h" #include "internal.h" @@ -131,9 +132,9 @@ static int rsd_read_header(AVFormatContext *s) return ret; for (i = 0; i < par->ch_layout.nb_channels; i++) { - if (avio_feof(pb)) - return AVERROR_EOF; - avio_read(s->pb, st->codecpar->extradata + 32 * i, 32); + ret = ffio_read_size(s->pb, st->codecpar->extradata + 32 * i, 32); + if (ret < 0) + return ret; avio_skip(s->pb, 8); } break;