Skip to content

Commit ed188f6

Browse files
committed
avformat/aadec: Check for scanf() failure
Fixes: use of uninitialized variables Fixes: blank.aa Found-by: Chamal De Silva <chamal.desilva@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
1 parent 9570322 commit ed188f6

File tree

1 file changed

+6
-1
lines changed

1 file changed

+6
-1
lines changed

Diff for: libavformat/aadec.c

+6-1
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,7 @@ static int aa_read_header(AVFormatContext *s)
8585
AADemuxContext *c = s->priv_data;
8686
AVIOContext *pb = s->pb;
8787
AVStream *st;
88+
int ret;
8889

8990
/* parse .aa header */
9091
avio_skip(pb, 4); // file size
@@ -118,8 +119,12 @@ static int aa_read_header(AVFormatContext *s)
118119
header_seed = atoi(val);
119120
} else if (!strcmp(key, "HeaderKey")) { // this looks like "1234567890 1234567890 1234567890 1234567890"
120121
av_log(s, AV_LOG_DEBUG, "HeaderKey is <%s>\n", val);
121-
sscanf(val, "%"SCNu32"%"SCNu32"%"SCNu32"%"SCNu32,
122+
123+
ret = sscanf(val, "%"SCNu32"%"SCNu32"%"SCNu32"%"SCNu32,
122124
&header_key_part[0], &header_key_part[1], &header_key_part[2], &header_key_part[3]);
125+
if (ret != 4)
126+
return AVERROR_INVALIDDATA;
127+
123128
for (idx = 0; idx < 4; idx++) {
124129
AV_WB32(&header_key[idx * 4], header_key_part[idx]); // convert each part to BE!
125130
}

0 commit comments

Comments
 (0)