diff options
| author | Matt Wolenetz <wolenetz@google.com> | 2016-12-14 15:26:19 -0800 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2017-02-08 21:17:51 +0100 |
| commit | 4adc99ecb6e9aec301fdd79ec097d433346045b6 (patch) | |
| tree | 8c6481b3a3e8e3b47f8300a7d97e5bf239f8b7f3 | |
| parent | 8be3724e55b2c55337c14c9cb7a69c5a85d42a65 (diff) | |
| download | ffmpeg-4adc99ecb6e9aec301fdd79ec097d433346045b6.tar.gz | |
lavf/mov.c: Avoid heap allocation wrap in mov_read_uuid
Core of patch is from paul@paulmehta.com
Reference https://crbug.com/643951
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Check value reduced as the code does not support values beyond INT_MAX
Also the check is moved to a more common place and before integer truncation
(cherry picked from commit 2d453188c2303da641dafb048dc1806790526dfd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/mov.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavformat/mov.c b/libavformat/mov.c index 44909e3495..017df0fbc0 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -3810,7 +3810,7 @@ static int mov_read_uuid(MOVContext *c, AVIOContext *pb, MOVAtom atom) 0xba, 0x2f, 0x08, 0x00, 0x20, 0x0c, 0x9a, 0x66 }; - if (atom.size < sizeof(uuid) || atom.size == INT64_MAX) + if (atom.size < sizeof(uuid) || atom.size >= FFMIN(INT_MAX, SIZE_MAX)) return AVERROR_INVALIDDATA; ret = avio_read(pb, uuid, sizeof(uuid)); |