virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-01-29 22:00:58 +02:00
Code Issues Releases Activity

avformat/mov: Check sample size

Browse Source 
Fixes integer overflow
Fixes: poc.mp4

Found-by: ajax secure <ajax4sec@hotmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8a3221cc67a516dfc1700bdae3566ec52c7ee823)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2016-06-28 23:49:36 +02:00
parent 4a0b0cffc1
commit 054db63120
1 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
libavformat/mov.c
View File

@ -2704,7 +2704,12 @@ static void mov_build_index(MOVContext *mov, AVStream *st)
sample_size = sc->stsz_sample_size > 0 ? sc->stsz_sample_size : sc->sample_sizes[current_sample];
if (sc->pseudo_stream_id == -1 ||
sc->stsc_data[stsc_index].id - 1 == sc->pseudo_stream_id) {
AVIndexEntry *e = &st->index_entries[st->nb_index_entries++];
AVIndexEntry *e;
if (sample_size > 0x3FFFFFFF) {
av_log(mov->fc, AV_LOG_ERROR, "Sample size %u is too large\n", sample_size);
return;
}
e = &st->index_entries[st->nb_index_entries++];
e->pos = current_offset;
e->timestamp = current_dts;
e->size = sample_size;
@ -2829,6 +2834,10 @@ static void mov_build_index(MOVContext *mov, AVStream *st)
av_log(mov->fc, AV_LOG_ERROR, "wrong chunk count %d\n", total);
return;
}
if (size > 0x3FFFFFFF) {
av_log(mov->fc, AV_LOG_ERROR, "Sample size %u is too large\n", size);
return;
}
e = &st->index_entries[st->nb_index_entries++];
e->pos = current_offset;
e->timestamp = current_dts;