[FFmpeg-cvslog] avformat/mov: fix integer overflow of size
Michael Niedermayer
git at videolan.org
Fri Dec 19 16:08:40 CET 2014
ffmpeg | branch: release/2.4 | Michael Niedermayer <michaelni at gmx.at> | Tue Dec 16 21:29:27 2014 +0100| [ea5b4c682caeb8beb2617a031211a89fbb1ad01a] | committer: Michael Niedermayer
avformat/mov: fix integer overflow of size
Fixes: case1_call_stack_overflow.mp4
Found-by: Michal Zalewski <lcamtuf at coredump.cx>
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ea5b4c682caeb8beb2617a031211a89fbb1ad01a
---
libavformat/mov.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 0603717..7806ef5 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -1453,7 +1453,7 @@ static void mov_parse_stsd_audio(MOVContext *c, AVIOContext *pb,
static void mov_parse_stsd_subtitle(MOVContext *c, AVIOContext *pb,
AVStream *st, MOVStreamContext *sc,
- int size)
+ int64_t size)
{
// ttxt stsd contains display flags, justification, background
// color, fonts, and default styles, so fake an atom to read it
@@ -1518,10 +1518,10 @@ static int mov_rewrite_dvd_sub_extradata(AVStream *st)
static int mov_parse_stsd_data(MOVContext *c, AVIOContext *pb,
AVStream *st, MOVStreamContext *sc,
- int size)
+ int64_t size)
{
if (st->codec->codec_tag == MKTAG('t','m','c','d')) {
- if (ff_get_extradata(st->codec, pb, size) < 0)
+ if ((int)size != size || ff_get_extradata(st->codec, pb, size) < 0)
return AVERROR(ENOMEM);
if (size > 16) {
MOVStreamContext *tmcd_ctx = st->priv_data;
More information about the ffmpeg-cvslog
mailing list