PR #24213 opened by paulocsanz URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24213 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24213.patch
# Summary of changes This leaks uninitialized process heap through the public demux API. On a truncated .binka, av_read_frame still returns 0. The packet size is the length claimed in the file (uint16 + 4, up to 64 KiB), not the number of bytes that were read. The unread tail is whatever malloc left in that allocation. ffmpeg -c copy writes the whole packet into the output file, so those heap bytes leave the process as media. The binkaudio decoder is fed the same buffer. av_new_packet() only zeroes the 64-byte pad. binka_read_packet() then avio_read()s into pkt->data + 4, ignores the return value, stamps the declared size with AV_WL32, and returns success. ffio_read_size() makes a short read fail the packet (AVERROR_INVALIDDATA) instead of delivering uninitialized memory. Same class as 29f513a (fsb, up to ~2 MiB) and 4b47405 (genh). >From d27dcb6afc9a849a46845f0915a24c37c0b93f12 Mon Sep 17 00:00:00 2001 From: Paulo Cabral Sanz <[email protected]> Date: Tue, 18 Aug 2026 18:02:02 -0300 Subject: [PATCH] avformat/binka: reject truncated packet reads binka_read_packet() calls avio_read() into a buffer from av_new_packet() and ignores the return value. packet_alloc() only zeroes the 64-byte padding; the payload is left uninitialized. pkt_size is avio_rl16() + 4 (max 65539). On a truncated file the demuxer still returns 0, so av_read_frame delivers up to 64 KiB of uninitialized heap per packet. ffmpeg -c copy writes those bytes into the output. Use ffio_read_size() so a short read fails the packet with AVERROR_INVALIDDATA. Same class as 29f513a (fsb) and 4b47405 (genh). Signed-off-by: Paulo Cabral Sanz <[email protected]> --- libavformat/binka.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libavformat/binka.c b/libavformat/binka.c index df853890c1..e8a8efae3d 100644 --- a/libavformat/binka.c +++ b/libavformat/binka.c @@ -20,6 +20,7 @@ #include "libavutil/intreadwrite.h" #include "avformat.h" +#include "avio_internal.h" #include "demux.h" #include "internal.h" @@ -80,7 +81,9 @@ static int binka_read_packet(AVFormatContext *s, AVPacket *pkt) if (ret < 0) return ret; - avio_read(pb, pkt->data + 4, pkt_size - 4); + ret = ffio_read_size(pb, pkt->data + 4, pkt_size - 4); + if (ret < 0) + return ret; AV_WL32(pkt->data, pkt_size); pkt->pos = pos; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
