aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMatt Wolenetz <wolenetz@google.com>2017-02-08 15:40:46 -0800
committerMichael Niedermayer <michael@niedermayer.cc>2017-02-10 12:14:39 +0100
commit927e59b74acc5286f9e8eeac0fb118410db1c09a (patch)
tree55c061f56e6cdab42d690e6330112f00184661ee
parentcbe65ccfa02a9061cead73a6685eef90225c41b5 (diff)
downloadffmpeg-927e59b74acc5286f9e8eeac0fb118410db1c09a.tar.gz
lavf/mov.c: Avoid OOB in mov_read_udta_string()
Core of patch is from paul@paulmehta.com Reference https://crbug.com/643952 (udta_string portion) Signed-off-by: Matt Wolenetz <wolenetz@chromium.org> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 9bbdf5d921ef57e1698f64981e4ea04db7c56fb5) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-rw-r--r--libavformat/mov.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 74b5825578..598ef397c6 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -404,11 +404,11 @@ retry:
return ret;
} else if (!key && c->found_hdlr_mdta && c->meta_keys) {
uint32_t index = AV_RB32(&atom.type);
- if (index < c->meta_keys_count) {
+ if (index < c->meta_keys_count && index > 0) {
key = c->meta_keys[index];
} else {
av_log(c->fc, AV_LOG_WARNING,
- "The index of 'data' is out of range: %d >= %d.\n",
+ "The index of 'data' is out of range: %d < 1 or >= %d.\n",
index, c->meta_keys_count);
}
}