This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new c2394a0ff3 avformat/binka: reject truncated packet reads
c2394a0ff3 is described below
commit c2394a0ff339484e54f757114dd0e7502fdf2fab
Author: Paulo Cabral Sanz <[email protected]>
AuthorDate: Tue Aug 18 18:02:02 2026 -0300
Commit: michaelni <[email protected]>
CommitDate: Mon Aug 31 13:44:32 2026 +0000
avformat/binka: reject truncated packet reads
binka_read_packet() calls avio_read() into a buffer from av_new_packet()
and ignores the return value. packet_alloc() only zeroes the 64-byte
padding; the payload is left uninitialized.
pkt_size is avio_rl16() + 4 (max 65539). On a truncated file the demuxer
still returns 0, so av_read_frame delivers up to 64 KiB of uninitialized
heap per packet. ffmpeg -c copy writes those bytes into the output.
Use ffio_read_size() so a short read fails the packet with
AVERROR_INVALIDDATA. Same class as 29f513a (fsb) and 4b47405 (genh).
Signed-off-by: Paulo Cabral Sanz <[email protected]>
---
libavformat/binka.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/libavformat/binka.c b/libavformat/binka.c
index df853890c1..e8a8efae3d 100644
--- a/libavformat/binka.c
+++ b/libavformat/binka.c
@@ -20,6 +20,7 @@
#include "libavutil/intreadwrite.h"
#include "avformat.h"
+#include "avio_internal.h"
#include "demux.h"
#include "internal.h"
@@ -80,7 +81,9 @@ static int binka_read_packet(AVFormatContext *s, AVPacket
*pkt)
if (ret < 0)
return ret;
- avio_read(pb, pkt->data + 4, pkt_size - 4);
+ ret = ffio_read_size(pb, pkt->data + 4, pkt_size - 4);
+ if (ret < 0)
+ return ret;
AV_WL32(pkt->data, pkt_size);
pkt->pos = pos;
--
To stop receiving notification emails like this one, please contact
[email protected].
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
