av_packet_side_data_new() does not zero the payload it allocates, and avio_read() may return fewer bytes than requested on a truncated file without returning an error. The ICCP and EXIF paths only checked for a negative return, so a short read left the tail of the side-data buffer uninitialized and exposed it to the caller. Use ffio_read_size(), which fails on a short read, matching the XMP path in the same demuxer.
Signed-off-by: Anas Khan <[email protected]> --- libavformat/webp_anim_dec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavformat/webp_anim_dec.c b/libavformat/webp_anim_dec.c index badc36f936..672f126d7c 100644 --- a/libavformat/webp_anim_dec.c +++ b/libavformat/webp_anim_dec.c @@ -170,7 +170,7 @@ static int webp_anim_read_header(AVFormatContext *s) AV_PKT_DATA_ICC_PROFILE, size, 0); if (!sd) return AVERROR(ENOMEM); - ret = avio_read(pb, sd->data, size); + ret = ffio_read_size(pb, sd->data, size); if (ret < 0) return ret; ctx->has_iccp = 1; @@ -299,7 +299,7 @@ static int webp_anim_read_packet(AVFormatContext *s, AVPacket *pkt) AV_PKT_DATA_EXIF, size, 0); if (!sd) return AVERROR(ENOMEM); - ret = avio_read(pb, sd->data, size); + ret = ffio_read_size(pb, sd->data, size); if (ret < 0) return ret; ctx->has_exif = 1; -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
