This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/9.0 in repository ffmpeg.
commit 852f067ec119f163f38b756adfbe2c46c76a8423 Author: Paulo Cabral Sanz <[email protected]> AuthorDate: Tue Aug 18 18:02:02 2026 -0300 Commit: Michael Niedermayer <[email protected]> CommitDate: Fri Sep 4 21:54:00 2026 +0200 avformat/binka: reject truncated packet reads binka_read_packet() calls avio_read() into a buffer from av_new_packet() and ignores the return value. packet_alloc() only zeroes the 64-byte padding; the payload is left uninitialized. pkt_size is avio_rl16() + 4 (max 65539). On a truncated file the demuxer still returns 0, so av_read_frame delivers up to 64 KiB of uninitialized heap per packet. ffmpeg -c copy writes those bytes into the output. Use ffio_read_size() so a short read fails the packet with AVERROR_INVALIDDATA. Same class as 29f513a (fsb) and 4b47405 (genh). Signed-off-by: Paulo Cabral Sanz <[email protected]> (cherry picked from commit c2394a0ff339484e54f757114dd0e7502fdf2fab) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/binka.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libavformat/binka.c b/libavformat/binka.c index df853890c1..e8a8efae3d 100644 --- a/libavformat/binka.c +++ b/libavformat/binka.c @@ -20,6 +20,7 @@ #include "libavutil/intreadwrite.h" #include "avformat.h" +#include "avio_internal.h" #include "demux.h" #include "internal.h" @@ -80,7 +81,9 @@ static int binka_read_packet(AVFormatContext *s, AVPacket *pkt) if (ret < 0) return ret; - avio_read(pb, pkt->data + 4, pkt_size - 4); + ret = ffio_read_size(pb, pkt->data + 4, pkt_size - 4); + if (ret < 0) + return ret; AV_WL32(pkt->data, pkt_size); pkt->pos = pos; -- To stop receiving notification emails like this one, please contact [email protected]. _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
