Fixes: Use of uninitialized memory Fixes: 377642312/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-4554550985424896
Unified · Split
| @@ -282,7 +282,7 @@ int ff_iamf_read_packet(AVFormatContext *s, IAMFDemuxContext *c, · 281 unmodified lines | |||
| 282 | int read = 0; | 282 | int read = 0; |
| 283 | 283 | ||
| 284 | while (1) { | 284 | while (1) { |
| 285 | uint8_t header[MAX_IAMF_OBU_HEADER_SIZE + AV_INPUT_BUFFER_PADDING_SIZE]; | 285 | uint8_t header[MAX_IAMF_OBU_HEADER_SIZE + AV_INPUT_BUFFER_PADDING_SIZE] = {0}; |
| 286 | enum IAMF_OBU_Type type; | 286 | enum IAMF_OBU_Type type; |
| 287 | unsigned obu_size; | 287 | unsigned obu_size; |
| 288 | unsigned skip_samples, discard_padding; | 288 | unsigned skip_samples, discard_padding; |
| @@ -294,6 +294,8 @@ int ff_iamf_read_packet(AVFormatContext *s, IAMFDemuxContext *c, · 5 unmodified lines | |||
| 294 | size = avio_read(pb, header, FFMIN(MAX_IAMF_OBU_HEADER_SIZE, max_size)); | 294 | size = avio_read(pb, header, FFMIN(MAX_IAMF_OBU_HEADER_SIZE, max_size)); |
| 295 | if (size < 0) | 295 | if (size < 0) |
| 296 | return size; | 296 | return size; |
| 297 | if (size != FFMIN(MAX_IAMF_OBU_HEADER_SIZE, max_size)) | ||
| 298 | return AVERROR_INVALIDDATA; | ||
| 297 | 299 | ||
| 298 | len = ff_iamf_parse_obu_header(header, size, &obu_size, &start_pos, &type, | 300 | len = ff_iamf_parse_obu_header(header, size, &obu_size, &start_pos, &type, |
| 299 | &skip_samples, &discard_padding); | 301 | &skip_samples, &discard_padding); |