This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch release/9.0
in repository ffmpeg.
The following commit(s) were added to refs/heads/release/9.0 by this push:
new 7adfbe40dc libavformat/flvdec: validate avio_read size on extended data
7adfbe40dc is described below
commit 7adfbe40dcde598f93a6963d2f7b22cd75202ccc
Author: Marvin Scholz <[email protected]>
AuthorDate: Tue Oct 13 23:22:45 2026 +0000
Commit: Marvin Scholz <[email protected]>
CommitDate: Fri Oct 30 00:33:43 2026 +0000
libavformat/flvdec: validate avio_read size on extended data
Use ffio_read_size in flv_parse_mod_ex_data to ensure that an error is
returned
if the complete ex_size chunk wasn't read, instead of reading uninitialized
data.
This fixes a MemorySanitizer use-of-uninitialized-value issue where a short
read
would leave the buffer partially uninitialized before parsing nano_offset.
Signed-off-by: Marvin Scholz <[email protected]>
(cherry picked from commit 5385979defeac64931213559de8a04ff0a750b2c)
---
libavformat/flvdec.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/libavformat/flvdec.c b/libavformat/flvdec.c
index 03310503d1..f480cd38de 100644
--- a/libavformat/flvdec.c
+++ b/libavformat/flvdec.c
@@ -36,6 +36,7 @@
#include "libavutil/intreadwrite.h"
#include "libavutil/mastering_display_metadata.h"
#include "avformat.h"
+#include "avio_internal.h"
#include "demux.h"
#include "internal.h"
#include "flv.h"
@@ -1342,7 +1343,7 @@ static int flv_parse_mod_ex_data(AVFormatContext *s, int
*pkt_type, int *size, i
if (!ex_data)
return AVERROR(ENOMEM);
- ret = avio_read(s->pb, ex_data, ex_size);
+ ret = ffio_read_size(s->pb, ex_data, ex_size);
if (ret < 0) {
av_free(ex_data);
return ret;
--
To stop receiving notification emails like this one, please contact
[email protected].
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
