ffmpeg | branch: release/3.2 | Andreas Cadhalpun <andreas.cadhal...@googlemail.com> | Sun Jan 1 20:27:50 2017 +0100| [41fc098a8612ba1af98ea0713c929a1f32f3ae87] | committer: Michael Niedermayer
libopenmpt: add missing avio_read return value check This fixes heap-buffer-overflows in libopenmpt caused by interpreting the negative size value as unsigned size_t. Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Reviewed-by: Jörn Heusipp <osm...@problemloesungsmaschine.de> Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> (cherry picked from commit 367cac7827870054ae3bd6d4517e7b13f4f3f72c) Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=41fc098a8612ba1af98ea0713c929a1f32f3ae87 --- libavformat/libopenmpt.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavformat/libopenmpt.c b/libavformat/libopenmpt.c index e7091ef..35fd28f 100644 --- a/libavformat/libopenmpt.c +++ b/libavformat/libopenmpt.c @@ -82,6 +82,11 @@ static int read_header_openmpt(AVFormatContext *s) if (!buf) return AVERROR(ENOMEM); size = avio_read(s->pb, buf, size); + if (size < 0) { + av_log(s, AV_LOG_ERROR, "Reading input buffer failed.\n"); + av_freep(&buf); + return size; + } openmpt->module = openmpt_module_create_from_memory(buf, size, openmpt_logfunc, s, NULL); av_freep(&buf); _______________________________________________ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
