PR #25056 opened by Marvin Scholz (ePirat) URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25056 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25056.patch
Use ffio_read_size in flv_parse_mod_ex_data to ensure that an error is returned if the complete ex_size chunk wasn't read, instead of reading uninitialized data. This fixes a MemorySanitizer use-of-uninitialized-value issue where a short read would leave the buffer partially uninitialized before parsing nano_offset. >From f6fe96247acfa91555281b08f2ec8a5ab73cb8fe Mon Sep 17 00:00:00 2001 From: Marvin Scholz <[email protected]> Date: Tue, 13 Oct 2026 23:22:45 +0000 Subject: [PATCH] libavformat/flvdec: validate avio_read size on extended data Use ffio_read_size in flv_parse_mod_ex_data to ensure that an error is returned if the complete ex_size chunk wasn't read, instead of reading uninitialized data. This fixes a MemorySanitizer use-of-uninitialized-value issue where a short read would leave the buffer partially uninitialized before parsing nano_offset. Signed-off-by: Marvin Scholz <[email protected]> --- libavformat/flvdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/flvdec.c b/libavformat/flvdec.c index e4bc8ebd83..615c339f46 100644 --- a/libavformat/flvdec.c +++ b/libavformat/flvdec.c @@ -1342,7 +1342,7 @@ static int flv_parse_mod_ex_data(AVFormatContext *s, int *pkt_type, int *size, i if (!ex_data) return AVERROR(ENOMEM); - ret = avio_read(s->pb, ex_data, ex_size); + ret = ffio_read_size(s->pb, ex_data, ex_size); if (ret < 0) { av_free(ex_data); return ret; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
