This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg.
commit 4b47405e1c251405bfa5196e79aa395c59ad2323 Author: unfunnyatearug <[email protected]> AuthorDate: Tue Aug 18 14:46:35 2026 +0300 Commit: James Almer <[email protected]> CommitDate: Tue Aug 18 18:56:04 2026 +0000 avformat/genh: check thp extradata read and allocation the genh demuxer had the same short-read issue at one location. the read is now performed with `ffio_read_size()` so truncated input is rejected instead of leaving uninitialized data in the extradata. `ff_alloc_extradata()` also had its return value unchecked. if allocation failed, the code could dereference a null pointer. the return value is now checked. the affected path is capped at two channels, so the potential information leak is relatively small, but it is the same underlying bug class. Signed-off-by: unfunnyatearug <[email protected]> --- libavformat/genh.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/libavformat/genh.c b/libavformat/genh.c index deecca4a4c..32cad7382b 100644 --- a/libavformat/genh.c +++ b/libavformat/genh.c @@ -22,6 +22,7 @@ #include "libavutil/channel_layout.h" #include "libavutil/intreadwrite.h" #include "avformat.h" +#include "avio_internal.h" #include "demux.h" #include "internal.h" @@ -132,14 +133,18 @@ static int genh_read_header(AVFormatContext *s) return AVERROR_PATCHWELCOME; } - ff_alloc_extradata(st->codecpar, 32 * st->codecpar->ch_layout.nb_channels); + ret = ff_alloc_extradata(st->codecpar, 32 * st->codecpar->ch_layout.nb_channels); + if (ret < 0) + return ret; for (ch = 0; ch < st->codecpar->ch_layout.nb_channels; ch++) { if (coef_type & 1) { avpriv_request_sample(s, "coef_type & 1"); return AVERROR_PATCHWELCOME; } else { avio_seek(s->pb, coef[ch], SEEK_SET); - avio_read(s->pb, st->codecpar->extradata + 32 * ch, 32); + ret = ffio_read_size(s->pb, st->codecpar->extradata + 32 * ch, 32); + if (ret < 0) + return ret; } } -- To stop receiving notification emails like this one, please contact [email protected]. _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
