diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2014-12-16 21:29:27 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-12-22 03:17:55 +0100 |
| commit | 4400385d5fd6a9d0b3381fe8be5c5ff7357561ed (patch) | |
| tree | ef7068d1ad43e2fb4f37fd14527e3f3a9d0f2004 | |
| parent | d85e25fe0b52fd37cbcc9cffb440219fbdd9bb3d (diff) | |
| download | ffmpeg-4400385d5fd6a9d0b3381fe8be5c5ff7357561ed.tar.gz | |
avformat/mov: fix integer overflow of size
Fixes: case1_call_stack_overflow.mp4
Found-by: Michal Zalewski <lcamtuf@coredump.cx>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit be9ce6e10a8d53b8bc346c9337d75a5a30631a2a)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavformat/mov.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/libavformat/mov.c b/libavformat/mov.c index 76a39c984b..57e4524e35 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -1550,7 +1550,7 @@ static void mov_parse_stsd_audio(MOVContext *c, AVIOContext *pb, static void mov_parse_stsd_subtitle(MOVContext *c, AVIOContext *pb, AVStream *st, MOVStreamContext *sc, - int size) + int64_t size) { // ttxt stsd contains display flags, justification, background // color, fonts, and default styles, so fake an atom to read it @@ -1615,10 +1615,10 @@ static int mov_rewrite_dvd_sub_extradata(AVStream *st) static int mov_parse_stsd_data(MOVContext *c, AVIOContext *pb, AVStream *st, MOVStreamContext *sc, - int size) + int64_t size) { if (st->codec->codec_tag == MKTAG('t','m','c','d')) { - if (ff_get_extradata(st->codec, pb, size) < 0) + if ((int)size != size || ff_get_extradata(st->codec, pb, size) < 0) return AVERROR(ENOMEM); if (size > 16) { MOVStreamContext *tmcd_ctx = st->priv_data; |