PR #24658 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24658 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24658.patch
Not really a security issue Fixes: stale header text parsed after a short read Fixes: gvif3SQQV4tm Found-by: zhang xingxing Suggested-by: zhang xingxing Signed-off-by: Michael Niedermayer <[email protected]> >From 0c250526a977f1b765d2c3d6f2e01983b6509fe5 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Wed, 23 Sep 2026 23:52:30 +0200 Subject: [PATCH] avformat/vivo: fail on a short read of a text header packet Not really a security issue Fixes: stale header text parsed after a short read Fixes: gvif3SQQV4tm Found-by: zhang xingxing Suggested-by: zhang xingxing Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/vivo.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libavformat/vivo.c b/libavformat/vivo.c index c20788f8bb..20e51d0082 100644 --- a/libavformat/vivo.c +++ b/libavformat/vivo.c @@ -29,6 +29,7 @@ #include "libavutil/avstring.h" #include "libavutil/parseutils.h" #include "avformat.h" +#include "avio_internal.h" #include "demux.h" #include "internal.h" @@ -146,7 +147,8 @@ static int vivo_read_header(AVFormatContext *s) break; if (vivo->length <= 1024) { - avio_read(s->pb, vivo->text, vivo->length); + if ((ret = ffio_read_size(s->pb, vivo->text, vivo->length)) < 0) + return ret; vivo->text[vivo->length] = 0; } else { av_log(s, AV_LOG_WARNING, "too big header, skipping\n"); -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
