Commit 5385979def for ffmpeg
commit 5385979defeac64931213559de8a04ff0a750b2c
Author: Marvin Scholz <epirat07@gmail.com>
Date: Tue Oct 13 23:22:45 2026 +0000
libavformat/flvdec: validate avio_read size on extended data
Use ffio_read_size in flv_parse_mod_ex_data to ensure that an error is returned
if the complete ex_size chunk wasn't read, instead of reading uninitialized data.
This fixes a MemorySanitizer use-of-uninitialized-value issue where a short read
would leave the buffer partially uninitialized before parsing nano_offset.
Signed-off-by: Marvin Scholz <epirat07@gmail.com>
diff --git a/libavformat/flvdec.c b/libavformat/flvdec.c
index e4bc8ebd83..29bd7d6754 100644
--- a/libavformat/flvdec.c
+++ b/libavformat/flvdec.c
@@ -36,6 +36,7 @@
#include "libavutil/intreadwrite.h"
#include "libavutil/mastering_display_metadata.h"
#include "avformat.h"
+#include "avio_internal.h"
#include "demux.h"
#include "internal.h"
#include "flv.h"
@@ -1342,7 +1343,7 @@ static int flv_parse_mod_ex_data(AVFormatContext *s, int *pkt_type, int *size, i
if (!ex_data)
return AVERROR(ENOMEM);
- ret = avio_read(s->pb, ex_data, ex_size);
+ ret = ffio_read_size(s->pb, ex_data, ex_size);
if (ret < 0) {
av_free(ex_data);
return ret;