diff options
| author | Dale Curtis <dalecurtis@chromium.org> | 2018-08-30 15:18:25 -0700 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2018-11-18 02:20:44 +0100 |
| commit | a72d42b80ff4a9220cb20b2231d55ada0d6b0b3b (patch) | |
| tree | d97d35103bc0cf31a1fa417680cfeca427f1100f | |
| parent | 368e7a0994222442a46be577f38aedc18f97aeac (diff) | |
| download | ffmpeg-a72d42b80ff4a9220cb20b2231d55ada0d6b0b3b.tar.gz | |
avformat/mov: Error on too large stsd entry counts.
Entries are always at least 8 bytes per the parsing code, so if we
see an impossible entry count avoid massive allocations. This is
similar to an existing check in mov_read_stsc().
Since ff_mov_read_stsd_entries() does eof checks, an alternative
approach could be to clamp the entry count to atom.size / 8.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 320b631a99a9f759fd1d5460fd4e285d184b8186)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/mov.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/libavformat/mov.c b/libavformat/mov.c index 672a218bb0..272ef7b503 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -2335,7 +2335,8 @@ static int mov_read_stsd(MOVContext *c, AVIOContext *pb, MOVAtom atom) avio_rb24(pb); /* flags */ entries = avio_rb32(pb); /* entries */ - if (entries <= 0) { + /* Each entry contains a size (4 bytes) and format (4 bytes). */ + if (entries <= 0 || entries > atom.size / 8) { av_log(c->fc, AV_LOG_ERROR, "invalid STSD entries %d\n", entries); return AVERROR_INVALIDDATA; } |