PR #22896 opened by Ted Meyer (usepgp) URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22896 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22896.patch
in mov_read_dops, `size` bytes is allocated for `st->codecpar->extradata`, but ff_alloc_extradata doesn't memset, so the contents of that buffer are just old heap data. If `avio_read` reads fewer bytes than were requested, uninitialized data can still be left in the extradata buffer, which is operated on by AV_WL16A and AV_WL32A. I think the best solution here is to just check the read size and ensure it's filling the extradata buffer in it's entirety, or erroring out if there isn't enough data left. >From 3dfe3727ae8b0e2b873dcf8bb0e4252f10aab935 Mon Sep 17 00:00:00 2001 From: Ted Meyer <[email protected]> Date: Wed, 22 Apr 2026 13:40:53 -0700 Subject: [PATCH] avformat/mov: Check read size for opus extradata in mov_read_dops, `size` bytes is allocated for `st->codecpar->extradata`, but ff_alloc_extradata doesn't memset, so the contents of that buffer are just old heap data. If `avio_read` reads fewer bytes than were requested, uninitialized data can still be left in the extradata buffer, which is operated on by AV_WL16A and AV_WL32A. I think the best solution here is to just check the read size and ensure it's filling the extradata buffer in it's entirety, or erroring out if there isn't enough data left. --- libavformat/mov.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index dc9233b8a8..838fa3485a 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -8589,7 +8589,11 @@ static int mov_read_dops(MOVContext *c, AVIOContext *pb, MOVAtom atom) AV_WL32A(st->codecpar->extradata, MKTAG('O','p','u','s')); AV_WL32A(st->codecpar->extradata + 4, MKTAG('H','e','a','d')); AV_WB8(st->codecpar->extradata + 8, 1); /* OpusHead version */ - avio_read(pb, st->codecpar->extradata + 9, size - 9); + if ((ret = ffio_read_size(pb, st->codecpar->extradata + 9, size - 9)) < 0) { + av_freep(&st->codecpar->extradata); + st->codecpar->extradata_size = 0; + return ret; + } /* OpusSpecificBox is stored in big-endian, but OpusHead is little-endian; aside from the preceding magic and version they're -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
