diff options
| author | James Almer <jamrial@gmail.com> | 2024-06-28 21:06:53 -0300 |
|---|---|---|
| committer | James Almer <jamrial@gmail.com> | 2024-07-28 17:28:19 -0300 |
| commit | 2aa63784b533f461785c3e767e354e84c7e2c8c2 (patch) | |
| tree | e0052352ee85e689268b1478e97949e663bbf9bc /libavformat/mov.c | |
| parent | 39ced529b0588b4516cd94bd9b498fb06a387101 (diff) | |
| download | ffmpeg-2aa63784b533f461785c3e767e354e84c7e2c8c2.tar.gz | |
avformat/mov: check that sample and chunk count is 1 for HEIF
Fixes NULL pointer dereference in broken/fuzzed streams.
Signed-off-by: James Almer <jamrial@gmail.com>
Diffstat (limited to 'libavformat/mov.c')
| -rw-r--r-- | libavformat/mov.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/libavformat/mov.c b/libavformat/mov.c index b74e43e214..dc77599faa 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -10063,6 +10063,9 @@ static int mov_read_header(AVFormatContext *s) st->codecpar->width = item->width; st->codecpar->height = item->height; + if (sc->sample_count != 1 || sc->chunk_count != 1) + return AVERROR_INVALIDDATA; + sc->sample_sizes[0] = item->extent_length; sc->chunk_offsets[0] = item->extent_offset + offset; |