diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2022-07-28 14:42:43 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2022-08-28 23:07:07 +0200 |
| commit | 6f53f0d09ea4c9c7f7354f018a87ef840315207d (patch) | |
| tree | 3291cc3d19d667c98dff670feb33ad2f7ef4c332 | |
| parent | 30bd4831e6213cee64ed950d69d1732194cc6464 (diff) | |
| download | ffmpeg-6f53f0d09ea4c9c7f7354f018a87ef840315207d.tar.gz | |
avformat/mov: Check count sums in build_open_gop_key_points()
Fixes: ffmpeg.md
Fixes: Out of array access
Fixes: CVE-2022-2566
Found-by: Andy Nguyen <theflow@google.com>
Found-by: 3pvd <3pvd@google.com>
Reviewed-by: Andy Nguyen <theflow@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c953baa084607dd1d84c3bfcce3cf6a87c3e6e05)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/mov.c | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/libavformat/mov.c b/libavformat/mov.c index a644f9ac62..2b1131b911 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -3949,8 +3949,11 @@ static int build_open_gop_key_points(AVStream *st) /* Build an unrolled index of the samples */ sc->sample_offsets_count = 0; - for (uint32_t i = 0; i < sc->ctts_count; i++) + for (uint32_t i = 0; i < sc->ctts_count; i++) { + if (sc->ctts_data[i].count > INT_MAX - sc->sample_offsets_count) + return AVERROR(ENOMEM); sc->sample_offsets_count += sc->ctts_data[i].count; + } av_freep(&sc->sample_offsets); sc->sample_offsets = av_calloc(sc->sample_offsets_count, sizeof(*sc->sample_offsets)); if (!sc->sample_offsets) @@ -3969,8 +3972,11 @@ static int build_open_gop_key_points(AVStream *st) /* Build a list of open-GOP key samples */ sc->open_key_samples_count = 0; for (uint32_t i = 0; i < sc->sync_group_count; i++) - if (sc->sync_group[i].index == cra_index) + if (sc->sync_group[i].index == cra_index) { + if (sc->sync_group[i].count > INT_MAX - sc->open_key_samples_count) + return AVERROR(ENOMEM); sc->open_key_samples_count += sc->sync_group[i].count; + } av_freep(&sc->open_key_samples); sc->open_key_samples = av_calloc(sc->open_key_samples_count, sizeof(*sc->open_key_samples)); if (!sc->open_key_samples) @@ -3981,6 +3987,8 @@ static int build_open_gop_key_points(AVStream *st) if (sg->index == cra_index) for (uint32_t j = 0; j < sg->count; j++) sc->open_key_samples[k++] = sample_id; + if (sg->count > INT_MAX - sample_id) + return AVERROR_PATCHWELCOME; sample_id += sg->count; } |