[FFmpeg-devel] [PR] avformat/wtvdec: Check that language is fully read (PR #22254)

[FFmpeg-devel] [PR] avformat/wtvdec: Check that language is fully read (PR #22254)

[michaelni via ffmpeg-devel]

PR #22254 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22254
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22254.patch

Fixes: use-of-uninitialized-value
Fixes: 483856523/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-5221422609006592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


>From ad28d78639c4cbbb7f4975977e777206896e4e9e Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 22 Feb 2026 13:47:23 +0100
Subject: [PATCH] avformat/wtvdec: Check that language is fully read

Fixes: use-of-uninitialized-value
Fixes: 483856523/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-5221422609006592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/wtvdec.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/libavformat/wtvdec.c b/libavformat/wtvdec.c
index 1f299510c9..50d019a03f 100644
--- a/libavformat/wtvdec.c
+++ b/libavformat/wtvdec.c
@@ -881,7 +881,8 @@ static int parse_chunks(AVFormatContext *s, int mode, int64_t seekts, int *len_p
                 AVStream *st = s->streams[stream_index];
                 uint8_t language[4];
                 avio_skip(pb, 12);
-                avio_read(pb, language, 3);
+                if (avio_read(pb, language, 3) != 3)
+                    return AVERROR_INVALIDDATA;
                 if (language[0]) {
                     language[3] = 0;
                     av_dict_set(&st->metadata, "language", language, 0);
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org