aboutsummaryrefslogtreecommitdiffstats
path: root/libavformat/mov.c
diff options
context:
space:
mode:
authorJames Almer <jamrial@gmail.com>2024-04-01 21:13:04 -0300
committerJames Almer <jamrial@gmail.com>2024-04-01 21:13:04 -0300
commitf492f1ac239da07970c363fb8c7f7a1aa5b5002a (patch)
tree5a3d6d4d50d948ab573a1b2831c63d639505f2e7 /libavformat/mov.c
parenta8e518e3a7f7d5da969e7abba0f03f2ef0fd0203 (diff)
downloadffmpeg-f492f1ac239da07970c363fb8c7f7a1aa5b5002a.tar.gz
avformat/mov: ensure all items id referenced by a grid are valid
Fixes: null pointer dereference Fixes: 67494/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6528714521247744 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Tested-by: Michael Niedermayer <michael@niedermayer.cc> Signed-off-by: James Almer <jamrial@gmail.com>
Diffstat (limited to 'libavformat/mov.c')
-rw-r--r--libavformat/mov.c10
1 files changed, 9 insertions, 1 deletions
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 7bdeeb99f9..fb0113b149 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -9397,8 +9397,9 @@ static int mov_parse_tiles(AVFormatContext *s)
for (int j = 0; j < grid->nb_tiles; j++) {
int tile_id = grid->tile_id_list[j];
+ int k;
- for (int k = 0; k < mov->nb_heif_item; k++) {
+ for (k = 0; k < mov->nb_heif_item; k++) {
HEIFItem *item = &mov->heif_item[k];
AVStream *st = item->st;
@@ -9424,6 +9425,13 @@ static int mov_parse_tiles(AVFormatContext *s)
break;
}
+ if (k == grid->nb_tiles) {
+ av_log(s, AV_LOG_WARNING, "HEIF item id %d referenced by grid id %d doesn't "
+ "exist\n",
+ tile_id, grid->item->item_id);
+ ff_remove_stream_group(s, stg);
+ loop = 0;
+ }
if (!loop)
break;
}