[FFmpeg-devel] [PATCH] libavformat/rmdec.c: Fix Use-of-uninitialized-value in ff_codec_get_id

[Michael Niedermayer]

On Mon, Sep 14, 2020 at 10:49:00AM -0700, Thierry Foucu wrote:
> In case the pb does not contain 4 bytes, the buf[256] will not be
> initialize before we pass it to ff_codec_get_id
> ---
>  libavformat/rmdec.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c
> index a36e693ab2..220aa8aee2 100644
> --- a/libavformat/rmdec.c
> +++ b/libavformat/rmdec.c
> @@ -180,12 +180,12 @@ static int rm_read_audio_stream_info(AVFormatContext *s, AVIOContext *pb,
>          st->codecpar->sample_rate = avio_rb16(pb);
>          avio_rb32(pb);
>          st->codecpar->channels = avio_rb16(pb);
> +        AV_WL32(buf, 0);
>          if (version == 5) {
>              ast->deint_id = avio_rl32(pb);

>              avio_read(pb, buf, 4);

I think the avio_read() return code should be checked instead

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Good people do not need laws to tell them to act responsibly, while bad
people will find a way around the laws. -- Plato
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20200917/10d021d7/attachment.sig>