diff options
| author | Dale Curtis <dalecurtis@chromium.org> | 2024-02-02 20:49:44 +0000 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2024-02-21 18:23:41 +0100 |
| commit | 6ef32ea5748e9dcc2c8d1c076607b8d15650a5fe (patch) | |
| tree | 030c57262736a6f7a43d4a0ec353cc29c8c2e657 | |
| parent | a3f69cdec73dfddb132a89a524e1977dddfe46d0 (diff) | |
| download | ffmpeg-6ef32ea5748e9dcc2c8d1c076607b8d15650a5fe.tar.gz | |
Avoid OOM for invalid STCO / CO64 constructions.
The `entries` value is read directly from the stream and used to
allocate memory. This change clamps `entries` to however many are
possible in the remaining atom or file size (whichever is smallest).
Fixes https://crbug.com/1429357
Signed-off-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/mov.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/libavformat/mov.c b/libavformat/mov.c index 3a733aae9c..1a1b104615 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -2362,7 +2362,13 @@ static int mov_read_stco(MOVContext *c, AVIOContext *pb, MOVAtom atom) avio_r8(pb); /* version */ avio_rb24(pb); /* flags */ + // Clamp allocation size for `chunk_offsets` -- don't throw an error for an + // invalid count since the EOF path doesn't throw either. entries = avio_rb32(pb); + entries = + FFMIN(entries, + FFMAX(0, (atom.size - 8) / + (atom.type == MKTAG('s', 't', 'c', 'o') ? 4 : 8))); if (!entries) return 0; @@ -2371,6 +2377,7 @@ static int mov_read_stco(MOVContext *c, AVIOContext *pb, MOVAtom atom) av_log(c->fc, AV_LOG_WARNING, "Ignoring duplicated STCO atom\n"); return 0; } + av_free(sc->chunk_offsets); sc->chunk_count = 0; sc->chunk_offsets = av_malloc_array(entries, sizeof(*sc->chunk_offsets)); |