diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2016-06-28 23:49:36 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2017-08-23 13:15:16 +0200 |
| commit | d7ab6e93a688688ad27c03ba3ba15711e59036dc (patch) | |
| tree | 40ae9a14a1282b246dfec726bb40afe6f6573a53 | |
| parent | a36a7d3b4387aacffbb14a43f5166d39c5f48ad0 (diff) | |
| download | ffmpeg-d7ab6e93a688688ad27c03ba3ba15711e59036dc.tar.gz | |
avformat/mov: Check sample size
Fixes integer overflow
Fixes: poc.mp4
Found-by: ajax secure <ajax4sec@hotmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8a3221cc67a516dfc1700bdae3566ec52c7ee823)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/mov.c | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/libavformat/mov.c b/libavformat/mov.c index 3246d0a49b..29641b45b5 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -2250,7 +2250,12 @@ static void mov_build_index(MOVContext *mov, AVStream *st) sample_size = sc->stsz_sample_size > 0 ? sc->stsz_sample_size : sc->sample_sizes[current_sample]; if (sc->pseudo_stream_id == -1 || sc->stsc_data[stsc_index].id - 1 == sc->pseudo_stream_id) { - AVIndexEntry *e = &st->index_entries[st->nb_index_entries++]; + AVIndexEntry *e; + if (sample_size > 0x3FFFFFFF) { + av_log(mov->fc, AV_LOG_ERROR, "Sample size %u is too large\n", sample_size); + return; + } + e = &st->index_entries[st->nb_index_entries++]; e->pos = current_offset; e->timestamp = current_dts; e->size = sample_size; @@ -2348,6 +2353,10 @@ static void mov_build_index(MOVContext *mov, AVStream *st) av_log(mov->fc, AV_LOG_ERROR, "wrong chunk count %d\n", total); return; } + if (size > 0x3FFFFFFF) { + av_log(mov->fc, AV_LOG_ERROR, "Sample size %u is too large\n", size); + return; + } e = &st->index_entries[st->nb_index_entries++]; e->pos = current_offset; e->timestamp = current_dts; |