[FFmpeg-devel] [PATCH 3/4] avformat/mxfdec: Ensure klv->key is initialized

[Michael Niedermayer]

On Thu, Jul 24, 2025 at 08:25:35PM +0200, Tomas Härdin wrote:
> tor 2025-07-24 klockan 00:51 +0200 skrev Marton Balint:
> > 
> > 
> > On Wed, 23 Jul 2025, Tomas Härdin wrote:
> > 
> > > ons 2025-07-23 klockan 13:45 +0200 skrev Michael Niedermayer:
> > > > Fixes: read of uninitialized memory
> > > > Fixes: 391916474/clusterfuzz-testcase-minimized-
> > > > ffmpeg_dem_MXF_fuzzer-4935250956845056
> > > > 
> > > > Found-by: continuous fuzzing process
> > > > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > > > Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> > > > ---
> > > >  libavformat/mxfdec.c | 4 +++-
> > > >  1 file changed, 3 insertions(+), 1 deletion(-)
> > > > 
> > > > diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
> > > > index 0eed13d850d..184e97256cd 100644
> > > > --- a/libavformat/mxfdec.c
> > > > +++ b/libavformat/mxfdec.c
> > > > @@ -491,7 +491,9 @@ static int klv_read_packet(MXFContext *mxf,
> > > > KLVPacket *klv, AVIOContext *pb)
> > > >          return AVERROR_INVALIDDATA;
> > > >  
> > > >      memcpy(klv->key, mxf_klv_key, 4);
> > > > -    avio_read(pb, klv->key + 4, 12);
> > > > +    int ret = ffio_read_size(pb, klv->key + 4, 12);
> > > > +    if (ret < 0)
> > > > +        return ret;
> > > 
> > > ret != 12 is better. If it's non-negative then return AVERROR_EOF
> > 
> > ffio_read_size always returns the requested size or negative.
> 
> Herp. Well in that case it's fine yes

will apply patchset

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Any man who breaks a law that conscience tells him is unjust and willingly 
accepts the penalty by staying in jail in order to arouse the conscience of 
the community on the injustice of the law is at that moment expressing the 
very highest respect for law. - Martin Luther King Jr
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20250728/4016dc79/attachment.sig>