From bda6ec0d52d8334af72cb3e4ea43c6fbe91e015d Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Thu, 8 Oct 2026 01:40:31 +0200
Subject: [PATCH] avformat/iff: Check the CMAP read size

Fixes: use of uninitialized memory
Fixes: 5bX0wHRp9uuN
Use of uninitialized memory Replicated through UnModified FFmpeg (ffprobe) with Valgrind
Found during triage of the security report fo0u77U9tJ8g
---
 libavformat/iff.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/iff.c b/libavformat/iff.c
index a8c10f6286..be400e48d5 100644
--- a/libavformat/iff.c
+++ b/libavformat/iff.c
@@ -568,7 +568,7 @@ static int iff_read_header(AVFormatContext *s)
                                      data_size + IFF_EXTRA_VIDEO_SIZE);
             if (res < 0)
                 return res;
-            if ((res = avio_read(pb, stv->codecpar->extradata + IFF_EXTRA_VIDEO_SIZE, data_size)) < 0) {
+            if ((res = ffio_read_size(pb, stv->codecpar->extradata + IFF_EXTRA_VIDEO_SIZE, data_size)) < 0) {
                 av_freep(&stv->codecpar->extradata);
                 stv->codecpar->extradata_size = 0;
                 return res;