[FFmpeg-cvslog] avformat/mov: check atom nesting depth
Michael Niedermayer
git at videolan.org
Mon Dec 22 03:32:51 CET 2014
ffmpeg | branch: release/2.5 | Michael Niedermayer <michaelni at gmx.at> | Tue Dec 16 21:14:40 2014 +0100| [d85e25fe0b52fd37cbcc9cffb440219fbdd9bb3d] | committer: Michael Niedermayer
avformat/mov: check atom nesting depth
Fixes call stack overflow
Fixes: case1_call_stack_overflow.mp4
Found-by: Michal Zalewski <lcamtuf at coredump.cx>
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
(cherry picked from commit caa7a3914f499f74b3ee346f26d598ebdc0ec210)
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d85e25fe0b52fd37cbcc9cffb440219fbdd9bb3d
---
libavformat/isom.h | 1 +
libavformat/mov.c | 13 ++++++++++++-
2 files changed, 13 insertions(+), 1 deletion(-)
diff --git a/libavformat/isom.h b/libavformat/isom.h
index e3160d0..249c3ab 100644
--- a/libavformat/isom.h
+++ b/libavformat/isom.h
@@ -189,6 +189,7 @@ typedef struct MOVContext {
int has_looked_for_mfra;
MOVFragmentIndex** fragment_index_data;
unsigned fragment_index_count;
+ int atom_depth;
} MOVContext;
int ff_mp4_read_descr_len(AVIOContext *pb);
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 8d66c0a..76a39c9 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -3388,6 +3388,12 @@ static int mov_read_default(MOVContext *c, AVIOContext *pb, MOVAtom atom)
MOVAtom a;
int i;
+ if (c->atom_depth > 10) {
+ av_log(c->fc, AV_LOG_ERROR, "Atoms too deeply nested\n");
+ return AVERROR_INVALIDDATA;
+ }
+ c->atom_depth ++;
+
if (atom.size < 0)
atom.size = INT64_MAX;
while (total_size + 8 <= atom.size && !avio_feof(pb)) {
@@ -3417,6 +3423,7 @@ static int mov_read_default(MOVContext *c, AVIOContext *pb, MOVAtom atom)
{
av_log(c->fc, AV_LOG_ERROR, "Broken file, trak/mdat not at top-level\n");
avio_skip(pb, -8);
+ c->atom_depth --;
return 0;
}
}
@@ -3453,13 +3460,16 @@ static int mov_read_default(MOVContext *c, AVIOContext *pb, MOVAtom atom)
int64_t start_pos = avio_tell(pb);
int64_t left;
int err = parse(c, pb, a);
- if (err < 0)
+ if (err < 0) {
+ c->atom_depth --;
return err;
+ }
if (c->found_moov && c->found_mdat &&
((!pb->seekable || c->fc->flags & AVFMT_FLAG_IGNIDX) ||
start_pos + a.size == avio_size(pb))) {
if (!pb->seekable || c->fc->flags & AVFMT_FLAG_IGNIDX)
c->next_root_atom = start_pos + a.size;
+ c->atom_depth --;
return 0;
}
left = a.size - avio_tell(pb) + start_pos;
@@ -3479,6 +3489,7 @@ static int mov_read_default(MOVContext *c, AVIOContext *pb, MOVAtom atom)
if (total_size < atom.size && atom.size < 0x7ffff)
avio_skip(pb, atom.size - total_size);
+ c->atom_depth --;
return 0;
}
More information about the ffmpeg-cvslog
mailing list