[FFmpeg-cvslog] avformat/mov: Check sample size
Michael Niedermayer
git at videolan.org
Fri Aug 26 15:41:02 EEST 2016
ffmpeg | branch: release/2.8 | Michael Niedermayer <michael at niedermayer.cc> | Tue Jun 28 23:49:36 2016 +0200| [054db631200c9940bc72e4dec2cb3c75e613abaf] | committer: Michael Niedermayer
avformat/mov: Check sample size
Fixes integer overflow
Fixes: poc.mp4
Found-by: ajax secure <ajax4sec at hotmail.com>
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
(cherry picked from commit 8a3221cc67a516dfc1700bdae3566ec52c7ee823)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=054db631200c9940bc72e4dec2cb3c75e613abaf
---
libavformat/mov.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 3351ae2..aa62087 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -2704,7 +2704,12 @@ static void mov_build_index(MOVContext *mov, AVStream *st)
sample_size = sc->stsz_sample_size > 0 ? sc->stsz_sample_size : sc->sample_sizes[current_sample];
if (sc->pseudo_stream_id == -1 ||
sc->stsc_data[stsc_index].id - 1 == sc->pseudo_stream_id) {
- AVIndexEntry *e = &st->index_entries[st->nb_index_entries++];
+ AVIndexEntry *e;
+ if (sample_size > 0x3FFFFFFF) {
+ av_log(mov->fc, AV_LOG_ERROR, "Sample size %u is too large\n", sample_size);
+ return;
+ }
+ e = &st->index_entries[st->nb_index_entries++];
e->pos = current_offset;
e->timestamp = current_dts;
e->size = sample_size;
@@ -2829,6 +2834,10 @@ static void mov_build_index(MOVContext *mov, AVStream *st)
av_log(mov->fc, AV_LOG_ERROR, "wrong chunk count %d\n", total);
return;
}
+ if (size > 0x3FFFFFFF) {
+ av_log(mov->fc, AV_LOG_ERROR, "Sample size %u is too large\n", size);
+ return;
+ }
e = &st->index_entries[st->nb_index_entries++];
e->pos = current_offset;
e->timestamp = current_dts;
More information about the ffmpeg-cvslog
mailing list