diff options
| author | Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> | 2015-05-22 22:58:55 +0200 |
|---|---|---|
| committer | Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> | 2015-05-23 10:36:44 +0200 |
| commit | 0b79a389ba488d50fd9947554d803fc51b877bb3 (patch) | |
| tree | bccf182d646397624536e67a41447c80e676cfd1 /libavformat/nutdec.c | |
| parent | 1096c46c55d6bbac5c2decbca49f083d079c1642 (diff) | |
| download | ffmpeg-0b79a389ba488d50fd9947554d803fc51b877bb3.tar.gz | |
nutdec: always check the get_str return value
If it fails, the buffers can be (partially) uninitialized.
This fixes 'Conditional jump or move depends on uninitialised value(s)'
valgrind warnings.
Reviewed-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Diffstat (limited to 'libavformat/nutdec.c')
| -rw-r--r-- | libavformat/nutdec.c | 27 |
1 files changed, 22 insertions, 5 deletions
diff --git a/libavformat/nutdec.c b/libavformat/nutdec.c index ad9053cf73..eeaf8bf9ae 100644 --- a/libavformat/nutdec.c +++ b/libavformat/nutdec.c @@ -544,11 +544,15 @@ static int decode_info_header(NUTContext *nut) if (value == -1) { type = "UTF-8"; - get_str(bc, str_value, sizeof(str_value)); + ret = get_str(bc, str_value, sizeof(str_value)); } else if (value == -2) { - get_str(bc, type_str, sizeof(type_str)); + ret = get_str(bc, type_str, sizeof(type_str)); + if (ret < 0) { + av_log(s, AV_LOG_ERROR, "get_str failed while decoding info header\n"); + return ret; + } type = type_str; - get_str(bc, str_value, sizeof(str_value)); + ret = get_str(bc, str_value, sizeof(str_value)); } else if (value == -3) { type = "s"; value = get_s(bc); @@ -562,6 +566,11 @@ static int decode_info_header(NUTContext *nut) type = "v"; } + if (ret < 0) { + av_log(s, AV_LOG_ERROR, "get_str failed while decoding info header\n"); + return ret; + } + if (stream_id_plus1 > s->nb_streams) { av_log(s, AV_LOG_ERROR, "invalid stream id for info packet\n"); continue; @@ -875,13 +884,21 @@ static int read_sm_data(AVFormatContext *s, AVIOContext *bc, AVPacket *pkt, int value = get_s(bc); if (value == -1) { - get_str(bc, str_value, sizeof(str_value)); + ret = get_str(bc, str_value, sizeof(str_value)); + if (ret < 0) { + av_log(s, AV_LOG_ERROR, "get_str failed while reading sm data\n"); + return ret; + } av_log(s, AV_LOG_WARNING, "Unknown string %s / %s\n", name, str_value); } else if (value == -2) { uint8_t *dst = NULL; int64_t v64, value_len; - get_str(bc, type_str, sizeof(type_str)); + ret = get_str(bc, type_str, sizeof(type_str)); + if (ret < 0) { + av_log(s, AV_LOG_ERROR, "get_str failed while reading sm data\n"); + return ret; + } value_len = ffio_read_varlen(bc); if (avio_tell(bc) + value_len >= maxpos) return AVERROR_INVALIDDATA; |