summaryrefslogtreecommitdiff
path: root/libavformat/mpc8.c
diff options
context:
space:
mode:
authorMichael Niedermayer <michaelni@gmx.at>2013-12-23 18:09:58 +0100
committerMichael Niedermayer <michaelni@gmx.at>2013-12-25 23:54:27 +0100
commite33b6ccfa782c6e04bcc5ef1b5138ad2a923f620 (patch)
treecce557c52282655aff0c7d61989c7e21750601c6 /libavformat/mpc8.c
parente079661d23ff3891cf663a85344d1f8eb60a4fe1 (diff)
downloadffmpeg-e33b6ccfa782c6e04bcc5ef1b5138ad2a923f620.tar.gz
avformat/mpc8: clear buffer padding area
Fixes use of uninitialized memory Fixes: msan_uninit-mem_7fa6a48cd1d5_8853_sv8_notags.mpc Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat/mpc8.c')
-rw-r--r--libavformat/mpc8.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/libavformat/mpc8.c b/libavformat/mpc8.c
index 0e9baaa426..502eaffe09 100644
--- a/libavformat/mpc8.c
+++ b/libavformat/mpc8.c
@@ -157,6 +157,8 @@ static void mpc8_parse_seektable(AVFormatContext *s, int64_t off)
if(!(buf = av_malloc(size + FF_INPUT_BUFFER_PADDING_SIZE)))
return;
avio_read(s->pb, buf, size);
+ memset(buf+size, 0, FF_INPUT_BUFFER_PADDING_SIZE);
+
init_get_bits(&gb, buf, size * 8);
size = gb_get_v(&gb);
if(size > UINT_MAX/4 || size > c->samples/1152){