diff options
| author | Mark Reid <mindmark@gmail.com> | 2014-08-10 12:01:33 -0700 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-08-10 21:32:05 +0200 |
| commit | cab39afb1a9c8a86a00485fbba12a9ba26bea57d (patch) | |
| tree | 9cbb2be6c12c37d6c02c20f841ec1fdca806be1a | |
| parent | bd879652476b1d57628f09531038ef4487fd68a6 (diff) | |
| download | ffmpeg-cab39afb1a9c8a86a00485fbba12a9ba26bea57d.tar.gz | |
avformat/movenc: check that reel_name length doesn't exceed UINT16_MAX
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavformat/movenc.c | 15 |
1 files changed, 12 insertions, 3 deletions
diff --git a/libavformat/movenc.c b/libavformat/movenc.c index 6a38e89d20..00dd7a3eb6 100644 --- a/libavformat/movenc.c +++ b/libavformat/movenc.c @@ -1340,13 +1340,22 @@ static int mov_write_rtp_tag(AVIOContext *pb, MOVTrack *track) return update_size(pb, pos); } -static int mov_write_source_reference_tag(AVIOContext *pb, MOVTrack *track, const char *reel_name){ +static int mov_write_source_reference_tag(AVIOContext *pb, MOVTrack *track, const char *reel_name) +{ + uint64_t str_size =strlen(reel_name); int64_t pos = avio_tell(pb); + + if (str_size >= UINT16_MAX){ + av_log(NULL, AV_LOG_ERROR, "reel_name length %llu is too large\n", str_size); + avio_wb16(pb, 0); + return AVERROR(EINVAL); + } + avio_wb32(pb, 0); /* size */ ffio_wfourcc(pb, "name"); /* Data format */ - avio_wb16(pb, strlen(reel_name)); /* string size */ + avio_wb16(pb, str_size); /* string size */ avio_wb16(pb, track->language); /* langcode */ - avio_write(pb, reel_name, strlen(reel_name)); /* reel name */ + avio_write(pb, reel_name, str_size); /* reel name */ return update_size(pb,pos); } |