generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

avformat/pva: Make sure the first byte of pes_header_data has been initialized

Browse Source 
Fixes use of uninitialized memory
Fixes: msan_uninit-mem_7f53c1d0e95c_2674_PVA_test-partial.pva
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2013-12-20 18:07:30 +01:00
parent d055a1395c
commit 5ec3c7b7c1
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
libavformat/pva.c
View File

@ -85,6 +85,7 @@ static int read_part_of_packet(AVFormatContext *s, int64_t *pts,
PVAContext *pvactx = s->priv_data; PVAContext *pvactx = s->priv_data;
int syncword, streamid, reserved, flags, length, pts_flag; int syncword, streamid, reserved, flags, length, pts_flag;
int64_t pva_pts = AV_NOPTS_VALUE, startpos; int64_t pva_pts = AV_NOPTS_VALUE, startpos;
int ret;
recover: recover:
startpos = avio_tell(pb); startpos = avio_tell(pb);
@ -133,8 +134,8 @@ recover:
pes_flags = avio_rb16(pb); pes_flags = avio_rb16(pb);
pes_header_data_length = avio_r8(pb); pes_header_data_length = avio_r8(pb);
if (pes_signal != 1) { if (pes_signal != 1 || pes_header_data_length == 0) {
pva_log(s, AV_LOG_WARNING, "expected signaled PES packet, " pva_log(s, AV_LOG_WARNING, "expected non empty signaled PES packet, "
"trying to recover\n"); "trying to recover\n");
avio_skip(pb, length - 9); avio_skip(pb, length - 9);
if (!read_packet) if (!read_packet)
@ -142,7 +143,9 @@ recover:
goto recover; goto recover;
} }
avio_read(pb, pes_header_data, pes_header_data_length); ret = avio_read(pb, pes_header_data, pes_header_data_length);
if (ret != pes_header_data_length)
return ret < 0 ? ret : AVERROR_INVALIDDATA;
length -= 9 + pes_header_data_length; length -= 9 + pes_header_data_length;
pes_packet_length -= 3 + pes_header_data_length; pes_packet_length -= 3 + pes_header_data_length;