aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMichael Niedermayer <michael@niedermayer.cc>2018-07-03 20:33:04 +0200
committerMichael Niedermayer <michael@niedermayer.cc>2018-07-07 12:27:00 +0200
commit5da77e7e9e91a1f2a6b80f64f4202c0a4534e307 (patch)
treee7d6fb639bd4a4ade7d8084049096f28e77a2be2
parent717ece29fd497500ef0315d1841fa7bd0640f53c (diff)
downloadffmpeg-5da77e7e9e91a1f2a6b80f64f4202c0a4534e307.tar.gz
avformat/mms: Add missing chunksize check
Fixes: out of array read Fixes: mms-crash-01b6c5d85f9d9f40f4e879896103e9f5b222816a Found-by: Paul Ch <paulcher@icloud.com> 1st hunk by Paul Ch <paulcher@icloud.com> Tested-by: Paul Ch <paulcher@icloud.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit cced03dd667a5df6df8fd40d8de0bff477ee02e8) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-rw-r--r--libavformat/mms.c44
1 files changed, 26 insertions, 18 deletions
diff --git a/libavformat/mms.c b/libavformat/mms.c
index 17fa76a8d4..768fda6525 100644
--- a/libavformat/mms.c
+++ b/libavformat/mms.c
@@ -94,24 +94,26 @@ int ff_mms_asf_header_parser(MMSContext *mms)
}
}
} else if (!memcmp(p, ff_asf_stream_header, sizeof(ff_asf_guid))) {
- flags = AV_RL16(p + sizeof(ff_asf_guid)*3 + 24);
- stream_id = flags & 0x7F;
- //The second condition is for checking CS_PKT_STREAM_ID_REQUEST packet size,
- //we can calculate the packet size by stream_num.
- //Please see function send_stream_selection_request().
- if (mms->stream_num < MMS_MAX_STREAMS &&
- 46 + mms->stream_num * 6 < sizeof(mms->out_buffer)) {
- mms->streams = av_fast_realloc(mms->streams,
- &mms->nb_streams_allocated,
- (mms->stream_num + 1) * sizeof(MMSStream));
- if (!mms->streams)
- return AVERROR(ENOMEM);
- mms->streams[mms->stream_num].id = stream_id;
- mms->stream_num++;
- } else {
- av_log(NULL, AV_LOG_ERROR,
- "Corrupt stream (too many A/V streams)\n");
- return AVERROR_INVALIDDATA;
+ if (end - p >= (sizeof(ff_asf_guid) * 3 + 26)) {
+ flags = AV_RL16(p + sizeof(ff_asf_guid)*3 + 24);
+ stream_id = flags & 0x7F;
+ //The second condition is for checking CS_PKT_STREAM_ID_REQUEST packet size,
+ //we can calculate the packet size by stream_num.
+ //Please see function send_stream_selection_request().
+ if (mms->stream_num < MMS_MAX_STREAMS &&
+ 46 + mms->stream_num * 6 < sizeof(mms->out_buffer)) {
+ mms->streams = av_fast_realloc(mms->streams,
+ &mms->nb_streams_allocated,
+ (mms->stream_num + 1) * sizeof(MMSStream));
+ if (!mms->streams)
+ return AVERROR(ENOMEM);
+ mms->streams[mms->stream_num].id = stream_id;
+ mms->stream_num++;
+ } else {
+ av_log(NULL, AV_LOG_ERROR,
+ "Corrupt stream (too many A/V streams)\n");
+ return AVERROR_INVALIDDATA;
+ }
}
} else if (!memcmp(p, ff_asf_ext_stream_header, sizeof(ff_asf_guid))) {
if (end - p >= 88) {
@@ -143,6 +145,12 @@ int ff_mms_asf_header_parser(MMSContext *mms)
}
} else if (!memcmp(p, ff_asf_head1_guid, sizeof(ff_asf_guid))) {
chunksize = 46; // see references [2] section 3.4. This should be set 46.
+ if (chunksize > end - p) {
+ av_log(NULL, AV_LOG_ERROR,
+ "Corrupt stream (header chunksize %"PRId64" is invalid)\n",
+ chunksize);
+ return AVERROR_INVALIDDATA;
+ }
}
p += chunksize;
}