From bb424927dbda787d2c7586bdf0b35ca2113247f5 Mon Sep 17 00:00:00 2001 From: Ruikai Peng Date: Thu, 11 Dec 2025 06:27:48 +0000 Subject: [PATCH] avformat/sierravmd: fix header read error check The header read check stored the comparison result into ret, so read failures became ret=1 and were treated as success, leaving the VMD header uninitialized and letting parsing continue with bogus state. Regression since: ee623a43e3. Found-by: Pwno --- libavformat/sierravmd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/sierravmd.c b/libavformat/sierravmd.c index bb1d1c5df7..2519756533 100644 --- a/libavformat/sierravmd.c +++ b/libavformat/sierravmd.c @@ -103,7 +103,7 @@ static int vmd_read_header(AVFormatContext *s) /* fetch the main header, including the 2 header length bytes */ avio_seek(pb, 0, SEEK_SET); - if ((ret = ffio_read_size(pb, vmd->vmd_header, VMD_HEADER_SIZE) < 0)) + if ((ret = ffio_read_size(pb, vmd->vmd_header, VMD_HEADER_SIZE)) < 0) return ret; width = AV_RL16(&vmd->vmd_header[12]);