If the buffer doesn't contain enough bytes when reading a stream, fail rather than continuing on with initialized data. Caught by Chromium fuzzeras (crbug.com/1065731).
Unified · Split
| @@ -89,13 +89,15 @@ static int amr_read_header(AVFormatContext *s) · 88 unmodified lines | |||
| 89 | AVStream *st; | 89 | AVStream *st; |
| 90 | uint8_t header[9]; | 90 | uint8_t header[9]; |
| 91 | 91 | ||
| 92 | avio_read(pb, header, 6); | 92 | if (avio_read(pb, header, 6) != 6) |
| 93 | return AVERROR_INVALIDDATA; | ||
| 93 | 94 | ||
| 94 | st = avformat_new_stream(s, NULL); | 95 | st = avformat_new_stream(s, NULL); |
| 95 | if (!st) | 96 | if (!st) |
| 96 | return AVERROR(ENOMEM); | 97 | return AVERROR(ENOMEM); |
| 97 | if (memcmp(header, AMR_header, 6)) { | 98 | if (memcmp(header, AMR_header, 6)) { |
| 98 | avio_read(pb, header + 6, 3); | 99 | if (avio_read(pb, header + 6, 3) != 3) |
| 100 | return AVERROR_INVALIDDATA; | ||
| 99 | if (memcmp(header, AMRWB_header, 9)) { | 101 | if (memcmp(header, AMRWB_header, 9)) { |
| 100 | return -1; | 102 | return -1; |
| 101 | } | 103 | } |