diff options
| author | James Almer <jamrial@gmail.com> | 2024-06-30 23:40:22 -0300 |
|---|---|---|
| committer | James Almer <jamrial@gmail.com> | 2024-07-03 19:54:31 -0300 |
| commit | cf7e2c5e055b6ad4dc629fcfadb40208d164c94c (patch) | |
| tree | abb56e75ba51b0e2b898a567e78404313f8bfbdb /libavformat/mov.c | |
| parent | 235ba14cc0e294d62e4fba58229f935c5551671a (diff) | |
| download | ffmpeg-cf7e2c5e055b6ad4dc629fcfadb40208d164c94c.tar.gz | |
avformat/mov: add more checks for infe atom size
Signed-off-by: James Almer <jamrial@gmail.com>
Diffstat (limited to 'libavformat/mov.c')
| -rw-r--r-- | libavformat/mov.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavformat/mov.c b/libavformat/mov.c index f07eab4d90..b4402d2bba 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -8484,6 +8484,8 @@ static int mov_read_infe(MOVContext *c, AVIOContext *pb, MOVAtom atom, int idx) version = avio_r8(pb); avio_rb24(pb); // flags. size -= 4; + if (size < 0) + return AVERROR_INVALIDDATA; if (version < 2) { avpriv_report_missing_feature(c->fc, "infe version < 2"); @@ -8495,6 +8497,8 @@ static int mov_read_infe(MOVContext *c, AVIOContext *pb, MOVAtom atom, int idx) avio_rb16(pb); // item_protection_index item_type = avio_rl32(pb); size -= 8; + if (size < 1) + return AVERROR_INVALIDDATA; av_bprint_init(&item_name, 0, AV_BPRINT_SIZE_UNLIMITED); ret = ff_read_string_to_bprint_overwrite(pb, &item_name, size); |