This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg.
commit 29f513af7833499ddff3f2443609356eacfdd665 Author: unfunnyatearug <[email protected]> AuthorDate: Tue Aug 18 14:46:35 2026 +0300 Commit: James Almer <[email protected]> CommitDate: Tue Aug 18 18:56:04 2026 +0000 avformat/fsb: reject truncated thp coefficient extradata the fsb demuxer used `avio_read(..., 32)` for each channel but ignored the return value. `ff_alloc_extradata()` only clears the padding area. if the input file is truncated, the remaining extradata can therefore contain uninitialized memory. `nb_channels` is a 16-bit value and was only limited by the `int_max / 32` calculation. this allows a truncated file to cause a leak of up to ~2 MB of uninitialized memory. the affected extradata is used by the `adpcm_thp` decoder and can also be copied to the output during remuxing. the fix replaces the unchecked reads with `ffio_read_size()`, which reports an error when the requested amount of data cannot be read. both the thp v3 and v4 paths are fixed. Signed-off-by: unfunnyatearug <[email protected]> --- libavformat/fsb.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/libavformat/fsb.c b/libavformat/fsb.c index 0febeffd56..1164f48b94 100644 --- a/libavformat/fsb.c +++ b/libavformat/fsb.c @@ -23,6 +23,7 @@ #include "libavutil/intreadwrite.h" #include "avformat.h" #include "avio.h" +#include "avio_internal.h" #include "demux.h" #include "internal.h" @@ -93,7 +94,9 @@ static int fsb_read_header(AVFormatContext *s) return ret; avio_seek(pb, 0x68, SEEK_SET); for (c = 0; c < par->ch_layout.nb_channels; c++) { - avio_read(pb, par->extradata + 32 * c, 32); + ret = ffio_read_size(pb, par->extradata + 32 * c, 32); + if (ret < 0) + return ret; avio_skip(pb, 14); } } else { @@ -146,7 +149,9 @@ static int fsb_read_header(AVFormatContext *s) return ret; avio_seek(pb, 0x80, SEEK_SET); for (c = 0; c < par->ch_layout.nb_channels; c++) { - avio_read(pb, par->extradata + 32 * c, 32); + ret = ffio_read_size(pb, par->extradata + 32 * c, 32); + if (ret < 0) + return ret; avio_skip(pb, 14); } par->block_align = 8 * par->ch_layout.nb_channels; -- To stop receiving notification emails like this one, please contact [email protected]. _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
