[FFmpeg-cvslog] avformat/mov: Check STSC and remove invalid entries
Michael Niedermayer
git at videolan.org
Fri Apr 13 02:58:07 EEST 2018
ffmpeg | branch: release/3.3 | Michael Niedermayer <michael at niedermayer.cc> | Fri Mar 16 19:53:36 2018 +0100| [a89b45b492dd3c82d9aab1d67dac21bf56bcf43d] | committer: Michael Niedermayer
avformat/mov: Check STSC and remove invalid entries
Fixes assertion failure
Fixes: crbug 822547, crbug 822666 and crbug 823009
Affects: aark15sd_9A62E2FA.mp4
Found-by: ClusterFuzz
Reviewed-by: Matt Wolenetz <wolenetz at google.com>
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
(cherry picked from commit 9e67447a4ffacf28af8bace33faf3ea432ddc43e)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a89b45b492dd3c82d9aab1d67dac21bf56bcf43d
---
libavformat/mov.c | 20 ++++++++++++++++++++
1 file changed, 20 insertions(+)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 5381dbb704..6124b0b573 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -2433,6 +2433,21 @@ static int mov_read_stsc(MOVContext *c, AVIOContext *pb, MOVAtom atom)
}
sc->stsc_count = i;
+ for (i = sc->stsc_count - 1; i < UINT_MAX; i--) {
+ if ((i+1 < sc->stsc_count && sc->stsc_data[i].first >= sc->stsc_data[i+1].first) ||
+ (i > 0 && sc->stsc_data[i].first <= sc->stsc_data[i-1].first) ||
+ sc->stsc_data[i].first < 1 ||
+ sc->stsc_data[i].count < 1 ||
+ sc->stsc_data[i].id < 1) {
+ av_log(c->fc, AV_LOG_WARNING, "STSC entry %d is invalid (first=%d count=%d id=%d)\n", i, sc->stsc_data[i].first, sc->stsc_data[i].count, sc->stsc_data[i].id);
+ if (i+1 >= sc->stsc_count || sc->stsc_data[i+1].first < 2)
+ return AVERROR_INVALIDDATA;
+ // We replace this entry by the next valid
+ sc->stsc_data[i].first = sc->stsc_data[i+1].first - 1;
+ sc->stsc_data[i].count = sc->stsc_data[i+1].count;
+ sc->stsc_data[i].id = sc->stsc_data[i+1].id;
+ }
+ }
if (pb->eof_reached)
return AVERROR_EOF;
@@ -3737,6 +3752,11 @@ static int mov_read_trak(MOVContext *c, AVIOContext *pb, MOVAtom atom)
st->index);
return 0;
}
+ if (sc->stsc_count && sc->stsc_data[ sc->stsc_count - 1 ].first > sc->chunk_count) {
+ av_log(c->fc, AV_LOG_ERROR, "stream %d, contradictionary STSC and STCO\n",
+ st->index);
+ return AVERROR_INVALIDDATA;
+ }
fix_timescale(c, sc);
More information about the ffmpeg-cvslog
mailing list