diff options
| author | Derek Buitenhuis <derek.buitenhuis@gmail.com> | 2016-04-13 17:30:42 +0100 |
|---|---|---|
| committer | Derek Buitenhuis <derek.buitenhuis@gmail.com> | 2016-04-13 17:30:47 +0100 |
| commit | bdd6275691dc8819bde083533943154c4204a768 (patch) | |
| tree | 5b80820bf7309dc045f80179a477854638327287 | |
| parent | 37f4cdb937806065da00d184c5d8dc9e2841dc4c (diff) | |
| parent | 7e01d48cfd168c3dfc663f03a3b6a98e0ecba328 (diff) | |
| download | ffmpeg-bdd6275691dc8819bde083533943154c4204a768.tar.gz | |
Merge commit '7e01d48cfd168c3dfc663f03a3b6a98e0ecba328'
* commit '7e01d48cfd168c3dfc663f03a3b6a98e0ecba328':
mov: Check the entries value when parsing dref boxes
Merged-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
| -rw-r--r-- | libavformat/mov.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/libavformat/mov.c b/libavformat/mov.c index 73bff0929b..42f8834771 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -515,9 +515,11 @@ static int mov_read_dref(MOVContext *c, AVIOContext *pb, MOVAtom atom) avio_rb32(pb); // version + flags entries = avio_rb32(pb); - if (entries > (atom.size - 1) / MIN_DATA_ENTRY_BOX_SIZE + 1 || + if (!entries || + entries > (atom.size - 1) / MIN_DATA_ENTRY_BOX_SIZE + 1 || entries >= UINT_MAX / sizeof(*sc->drefs)) return AVERROR_INVALIDDATA; + sc->drefs_count = 0; av_free(sc->drefs); sc->drefs_count = 0; sc->drefs = av_mallocz(entries * sizeof(*sc->drefs)); |