avformat/iamf_reader: Initialize padding and check read in ff_iamf_read_packet()

Fixes: Use of uninitialized memory Fixes: 377642312/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-4554550985424896

Michael Niedermayer committed 1 year ago

Commit aec29331 parent 788abe01 file · +3 −1Browse files

Unified · Split

libavformat/iamf_reader.c+3−1

@@ -282,7 +282,7 @@ int ff_iamf_read_packet(AVFormatContext s, IAMFDemuxContext c, · 281 unmodified lines
282	282	int read = 0;
283	283
284	284	while (1) {
285		− uint8_t header[MAX_IAMF_OBU_HEADER_SIZE + AV_INPUT_BUFFER_PADDING_SIZE];
	285	+ uint8_t header[MAX_IAMF_OBU_HEADER_SIZE + AV_INPUT_BUFFER_PADDING_SIZE] = {0};
286	286	enum IAMF_OBU_Type type;
287	287	unsigned obu_size;
288	288	unsigned skip_samples, discard_padding;
@@ -294,6 +294,8 @@ int ff_iamf_read_packet(AVFormatContext s, IAMFDemuxContext c, · 5 unmodified lines
294	294	size = avio_read(pb, header, FFMIN(MAX_IAMF_OBU_HEADER_SIZE, max_size));
295	295	if (size < 0)
296	296	return size;
	297	+ if (size != FFMIN(MAX_IAMF_OBU_HEADER_SIZE, max_size))
	298	+ return AVERROR_INVALIDDATA;
297	299
298	300	len = ff_iamf_parse_obu_header(header, size, &obu_size, &start_pos, &type,
299	301	&skip_samples, &discard_padding);