aboutsummaryrefslogtreecommitdiffstats
path: root/libavformat/mov.c
diff options
context:
space:
mode:
authorJames Almer <jamrial@gmail.com>2024-05-19 22:38:21 -0300
committerJames Almer <jamrial@gmail.com>2024-05-22 17:46:49 -0300
commit3146b77a7d314f55b8ec5d8ce6fda2c5db049a27 (patch)
tree80930b00fae07a515935d0286984ac873e3bf22e /libavformat/mov.c
parent2d84ee374528a8a8eed345a8147e146a0112e43a (diff)
downloadffmpeg-3146b77a7d314f55b8ec5d8ce6fda2c5db049a27.tar.gz
avformat/mov: store sample_sizes as unsigned ints
As defined in Section 8.7.3.2.1 of ISO 14496-12. Any unsupported value will be rejected in mov_build_index() without outright aborting demuxing. Fixes ticket #11005. Signed-off-by: James Almer <jamrial@gmail.com>
Diffstat (limited to 'libavformat/mov.c')
-rw-r--r--libavformat/mov.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 6174a04c31..45eca74d1d 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -3308,9 +3308,9 @@ static int mov_read_stsz(MOVContext *c, AVIOContext *pb, MOVAtom atom)
for (i = 0; i < entries; i++) {
sc->sample_sizes[i] = get_bits_long(&gb, field_size);
- if (sc->sample_sizes[i] < 0) {
+ if (sc->sample_sizes[i] > INT64_MAX - sc->data_size) {
av_free(buf);
- av_log(c->fc, AV_LOG_ERROR, "Invalid sample size %d\n", sc->sample_sizes[i]);
+ av_log(c->fc, AV_LOG_ERROR, "Sample size overflow in STSZ\n");
return AVERROR_INVALIDDATA;
}
sc->data_size += sc->sample_sizes[i];