[PR] avformat/binka: reject truncated packet reads (PR #24213)

PR #24213 opened by paulocsanz
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24213
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24213.patch

# Summary of changes

This leaks uninitialized process heap through the public demux API.

On a truncated .binka, av_read_frame still returns 0. The packet
size is the length claimed in the file (uint16 + 4, up to 64 KiB),
not the number of bytes that were read. The unread tail is whatever
malloc left in that allocation. ffmpeg -c copy writes the whole
packet into the output file, so those heap bytes leave the process
as media. The binkaudio decoder is fed the same buffer.

av_new_packet() only zeroes the 64-byte pad. binka_read_packet()
then avio_read()s into pkt->data + 4, ignores the return value,
stamps the declared size with AV_WL32, and returns success.

ffio_read_size() makes a short read fail the packet
(AVERROR_INVALIDDATA) instead of delivering uninitialized memory.
Same class as 29f513a (fsb, up to ~2 MiB) and 4b47405 (genh).


>From d27dcb6afc9a849a46845f0915a24c37c0b93f12 Mon Sep 17 00:00:00 2001
From: Paulo Cabral Sanz <[email protected]>
Date: Tue, 18 Aug 2026 18:02:02 -0300
Subject: [PATCH] avformat/binka: reject truncated packet reads

binka_read_packet() calls avio_read() into a buffer from av_new_packet()
and ignores the return value. packet_alloc() only zeroes the 64-byte
padding; the payload is left uninitialized.

pkt_size is avio_rl16() + 4 (max 65539). On a truncated file the demuxer
still returns 0, so av_read_frame delivers up to 64 KiB of uninitialized
heap per packet. ffmpeg -c copy writes those bytes into the output.

Use ffio_read_size() so a short read fails the packet with
AVERROR_INVALIDDATA. Same class as 29f513a (fsb) and 4b47405 (genh).

Signed-off-by: Paulo Cabral Sanz <[email protected]>
---
 libavformat/binka.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/libavformat/binka.c b/libavformat/binka.c
index df853890c1..e8a8efae3d 100644
--- a/libavformat/binka.c
+++ b/libavformat/binka.c
@@ -20,6 +20,7 @@
 
 #include "libavutil/intreadwrite.h"
 #include "avformat.h"
+#include "avio_internal.h"
 #include "demux.h"
 #include "internal.h"
 
@@ -80,7 +81,9 @@ static int binka_read_packet(AVFormatContext *s, AVPacket *pkt)
     if (ret < 0)
         return ret;
 
-    avio_read(pb, pkt->data + 4, pkt_size - 4);
+    ret = ffio_read_size(pb, pkt->data + 4, pkt_size - 4);
+    if (ret < 0)
+        return ret;
     AV_WL32(pkt->data, pkt_size);
 
     pkt->pos = pos;
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]