har0ke/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

lavf/id3v2: fail read_apic on EOF reading mimetype

Browse Source 
avio_read may return EOF, leaving the mimetype array unitialized. fail
early when this occurs to avoid using the array in an unitialized state.

Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
chcunningham 2018-12-14 13:44:07 -08:00 committed by Michael Niedermayer
parent 826655d8d1
commit ee1e39a576
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libavformat/id3v2.c
View File

@ -591,7 +591,7 @@ static void read_apic(AVFormatContext *s, AVIOContext *pb, int taglen,
int isv34) int isv34)
{ {
int enc, pic_type; int enc, pic_type;
char mimetype[64]; char mimetype[64] = {0};
const CodecMime *mime = ff_id3v2_mime_tags; const CodecMime *mime = ff_id3v2_mime_tags;
enum AVCodecID id = AV_CODEC_ID_NONE; enum AVCodecID id = AV_CODEC_ID_NONE;
ID3v2ExtraMetaAPIC *apic = NULL; ID3v2ExtraMetaAPIC *apic = NULL;
@ -613,7 +613,9 @@ static void read_apic(AVFormatContext *s, AVIOContext *pb, int taglen,
if (isv34) { if (isv34) {
taglen -= avio_get_str(pb, taglen, mimetype, sizeof(mimetype)); taglen -= avio_get_str(pb, taglen, mimetype, sizeof(mimetype));
} else { } else {
avio_read(pb, mimetype, 3); if (avio_read(pb, mimetype, 3) < 0)
goto fail;
mimetype[3] = 0; mimetype[3] = 0;
taglen -= 3; taglen -= 3;
} }