libopenmpt: add missing avio_read return value check
authorAndreas Cadhalpun <andreas.cadhalpun@googlemail.com>
Sun, 1 Jan 2017 19:27:50 +0000 (20:27 +0100)
committerMichael Niedermayer <michael@niedermayer.cc>
Mon, 16 Jan 2017 01:54:04 +0000 (02:54 +0100)
This fixes heap-buffer-overflows in libopenmpt caused by interpreting
the negative size value as unsigned size_t.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Reviewed-by: Jörn Heusipp <osmanx@problemloesungsmaschine.de>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavformat/libopenmpt.c

index e7091ef..35fd28f 100644 (file)
@@ -82,6 +82,11 @@ static int read_header_openmpt(AVFormatContext *s)
     if (!buf)
         return AVERROR(ENOMEM);
     size = avio_read(s->pb, buf, size);
+    if (size < 0) {
+        av_log(s, AV_LOG_ERROR, "Reading input buffer failed.\n");
+        av_freep(&buf);
+        return size;
+    }
 
     openmpt->module = openmpt_module_create_from_memory(buf, size, openmpt_logfunc, s, NULL);
     av_freep(&buf);