If the buffer doesn't contain enough bytes when reading a stream, fail rather than continuing on with initialized data. Caught by Chromium fuzzeras (crbug.com/1065731).
Unified · Split
| @@ -89,13 +89,15 @@ static int amr_read_header(AVFormatContext *s) · 88 unmodified lines | ||
| 89 | 89 | AVStream *st; |
| 90 | 90 | uint8_t header[9]; |
| 91 | 91 | |
| 92 | − avio_read(pb, header, 6); | |
| 92 | + if (avio_read(pb, header, 6) != 6) | |
| 93 | + return AVERROR_INVALIDDATA; | |
| 93 | 94 | |
| 94 | 95 | st = avformat_new_stream(s, NULL); |
| 95 | 96 | if (!st) |
| 96 | 97 | return AVERROR(ENOMEM); |
| 97 | 98 | if (memcmp(header, AMR_header, 6)) { |
| 98 | − avio_read(pb, header + 6, 3); | |
| 99 | + if (avio_read(pb, header + 6, 3) != 3) | |
| 100 | + return AVERROR_INVALIDDATA; | |
| 99 | 101 | if (memcmp(header, AMRWB_header, 9)) { |
| 100 | 102 | return -1; |
| 101 | 103 | } |