diff options
| author | Matt Wolenetz <wolenetz@google.com> | 2017-02-08 15:40:46 -0800 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2017-02-10 12:14:39 +0100 |
| commit | 927e59b74acc5286f9e8eeac0fb118410db1c09a (patch) | |
| tree | 55c061f56e6cdab42d690e6330112f00184661ee | |
| parent | cbe65ccfa02a9061cead73a6685eef90225c41b5 (diff) | |
| download | ffmpeg-927e59b74acc5286f9e8eeac0fb118410db1c09a.tar.gz | |
lavf/mov.c: Avoid OOB in mov_read_udta_string()
Core of patch is from paul@paulmehta.com
Reference https://crbug.com/643952 (udta_string portion)
Signed-off-by: Matt Wolenetz <wolenetz@chromium.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9bbdf5d921ef57e1698f64981e4ea04db7c56fb5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/mov.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavformat/mov.c b/libavformat/mov.c index 74b5825578..598ef397c6 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -404,11 +404,11 @@ retry: return ret; } else if (!key && c->found_hdlr_mdta && c->meta_keys) { uint32_t index = AV_RB32(&atom.type); - if (index < c->meta_keys_count) { + if (index < c->meta_keys_count && index > 0) { key = c->meta_keys[index]; } else { av_log(c->fc, AV_LOG_WARNING, - "The index of 'data' is out of range: %d >= %d.\n", + "The index of 'data' is out of range: %d < 1 or >= %d.\n", index, c->meta_keys_count); } } |