[FFmpeg-devel] [PATCH 6/9] avformat/wavdec: fix s337m/spdif probing beyond data_end

[Tomas Härdin]

fre 2020-01-03 klockan 16:56 +0100 skrev Nicolas Gaullier:
> ---
>  libavformat/wavdec.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/libavformat/wavdec.c b/libavformat/wavdec.c
> index 2796905e1f..ccb9576b84 100644
> --- a/libavformat/wavdec.c
> +++ b/libavformat/wavdec.c
> @@ -78,7 +78,7 @@ static void set_spdif_s337m(AVFormatContext *s, WAVDemuxContext *wav)
>                  ret = AVERROR(ENOMEM);
>              } else {
>                  int64_t pos = avio_tell(s->pb);
> -                len = ret = avio_read(s->pb, buf, len);
> +                len = ret = avio_read(s->pb, buf, FFMIN(len, wav->data_end - pos));
>                  if (len >= 0) {
>                      ret = ff_spdif_probe(buf, len, &codec);
>                      if (ret > AVPROBE_SCORE_EXTENSION) {

Looks OK. I suppose this fixes a potential SIGSEGV too?

/Tomas