From 25ce1c8333337ca27cd0ca54da2179f122a0dc83 Mon Sep 17 00:00:00 2001 From: James Almer Date: Tue, 20 Jun 2023 17:25:58 -0300 Subject: [PATCH] avformat/id3v2: check the return value of avio_close_dyn_buf() Fixes ticket #10424. Reviewed-by: Michael Niedermayer Signed-off-by: James Almer --- libavformat/id3v2.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/libavformat/id3v2.c b/libavformat/id3v2.c index cb31864045..38c86a8e79 100644 --- a/libavformat/id3v2.c +++ b/libavformat/id3v2.c @@ -246,7 +246,7 @@ static int decode_str(AVFormatContext *s, AVIOContext *pb, int encoding, int ret; uint8_t tmp; uint32_t ch = 1; - int left = *maxread; + int left = *maxread, dynsize; unsigned int (*get)(AVIOContext*) = avio_rb16; AVIOContext *dynbuf; @@ -308,7 +308,9 @@ static int decode_str(AVFormatContext *s, AVIOContext *pb, int encoding, if (ch) avio_w8(dynbuf, 0); - avio_close_dyn_buf(dynbuf, dst); + dynsize = avio_close_dyn_buf(dynbuf, dst); + if (dynsize <= 0) + return AVERROR(ENOMEM); *maxread = left; return 0;