aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMatt Wolenetz <wolenetz@google.com>2016-12-14 15:26:19 -0800
committerMichael Niedermayer <michael@niedermayer.cc>2017-02-08 11:05:51 +0100
commitdc1e099bf281e69d162bde02bd87112bbcb1ab5c (patch)
treec5e5a9adb477b013eb0a7c99dba9898e98524420
parent4f7064c9da35cd8156f6aee4a25e9b4e7f4ae607 (diff)
downloadffmpeg-dc1e099bf281e69d162bde02bd87112bbcb1ab5c.tar.gz
lavf/mov.c: Avoid heap allocation wrap in mov_read_uuid
Core of patch is from paul@paulmehta.com Reference https://crbug.com/643951 Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> Check value reduced as the code does not support values beyond INT_MAX Also the check is moved to a more common place and before integer truncation (cherry picked from commit 2d453188c2303da641dafb048dc1806790526dfd) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-rw-r--r--libavformat/mov.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/libavformat/mov.c b/libavformat/mov.c
index e6b6c67309..b03a4b947a 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -3901,7 +3901,7 @@ static int mov_read_uuid(MOVContext *c, AVIOContext *pb, MOVAtom atom)
0x9c, 0x71, 0x99, 0x94, 0x91, 0xe3, 0xaf, 0xac
};
- if (atom.size < sizeof(uuid) || atom.size == INT64_MAX)
+ if (atom.size < sizeof(uuid) || atom.size >= FFMIN(INT_MAX, SIZE_MAX))
return AVERROR_INVALIDDATA;
ret = avio_read(pb, uuid, sizeof(uuid));