diff options
| author | Jacob Trimble <modmaker-at-google.com@ffmpeg.org> | 2018-06-12 14:26:20 -0700 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2018-06-13 16:46:40 +0200 |
| commit | 4aba45ca1fece6be425d168c05aa3a7f9f05da36 (patch) | |
| tree | e29fcaca7ddb9f052bee093b739f83a1dea91f20 /libavformat | |
| parent | 9461e7d3a598e78811146b730db68d3a5b2532b0 (diff) | |
| download | ffmpeg-4aba45ca1fece6be425d168c05aa3a7f9f05da36.tar.gz | |
avformat/mov: Add check for per-sample IV size.
Found by Chrome's ClusterFuzz: http://crbug.com/849062.
Signed-off-by: Jacob Trimble <modmaker@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavformat')
| -rw-r--r-- | libavformat/mov.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/libavformat/mov.c b/libavformat/mov.c index 2fca025889..5d9ffa69a3 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -6273,8 +6273,13 @@ static int mov_read_tenc(MOVContext *c, AVIOContext *pb, MOVAtom atom) return AVERROR(ENOMEM); } sc->cenc.per_sample_iv_size = avio_r8(pb); + if (sc->cenc.per_sample_iv_size != 0 && sc->cenc.per_sample_iv_size != 8 && + sc->cenc.per_sample_iv_size != 16) { + av_log(c->fc, AV_LOG_ERROR, "invalid per-sample IV size value\n"); + return AVERROR_INVALIDDATA; + } if (avio_read(pb, sc->cenc.default_encrypted_sample->key_id, 16) != 16) { - av_log(c->fc, AV_LOG_ERROR, "failed to read the default key ID"); + av_log(c->fc, AV_LOG_ERROR, "failed to read the default key ID\n"); return AVERROR_INVALIDDATA; } @@ -6286,7 +6291,7 @@ static int mov_read_tenc(MOVContext *c, AVIOContext *pb, MOVAtom atom) } if (avio_read(pb, sc->cenc.default_encrypted_sample->iv, iv_size) != iv_size) { - av_log(c->fc, AV_LOG_ERROR, "failed to read the default IV"); + av_log(c->fc, AV_LOG_ERROR, "failed to read the default IV\n"); return AVERROR_INVALIDDATA; } } |