libavformat/amr.c: Check return value from avio_read()
authorJohn Rummell <jrummell@chromium.org>
Tue, 31 Mar 2020 04:30:33 +0000 (21:30 -0700)
committerMichael Niedermayer <michael@niedermayer.cc>
Thu, 2 Apr 2020 22:58:07 +0000 (00:58 +0200)
If the buffer doesn't contain enough bytes when reading a stream,
fail rather than continuing on with initialized data. Caught by
Chromium fuzzeras (crbug.com/1065731).

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavformat/amr.c

index eccbbde..b8a5deb 100644 (file)
@@ -89,13 +89,15 @@ static int amr_read_header(AVFormatContext *s)
     AVStream *st;
     uint8_t header[9];
 
-    avio_read(pb, header, 6);
+    if (avio_read(pb, header, 6) != 6)
+        return AVERROR_INVALIDDATA;
 
     st = avformat_new_stream(s, NULL);
     if (!st)
         return AVERROR(ENOMEM);
     if (memcmp(header, AMR_header, 6)) {
-        avio_read(pb, header + 6, 3);
+        if (avio_read(pb, header + 6, 3) != 3)
+            return AVERROR_INVALIDDATA;
         if (memcmp(header, AMRWB_header, 9)) {
             return -1;
         }