virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-01-13 21:28:01 +02:00
Code Issues Releases Activity

mov: fix a possible invalid read in mov_read_mac_string()

Browse Source 
When the input string is too large, so the second condition in if ()
fails, the code will erroneously execute the else branch, indexing the
mac_to_unicode table with a negative index.

CC: libav-stable@libav.org
Bug-Id: 1000
Found-By: Kamil Frankowicz
This commit is contained in:
Anton Khirnov 2016-12-17 14:17:20 +01:00
parent cfa4eb4fba
commit 46191a2da1
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libavformat/mov.c
View File

@ -161,7 +161,11 @@ static int mov_read_mac_string(MOVContext *c, AVIOContext *pb, int len,
for (i = 0; i < len; i++) {
uint8_t t, c = avio_r8(pb);
if (c < 0x80 && p < end)
if (p >= end)
continue;
if (c < 0x80)
*p++ = c;
else
PUT_UTF8(mac_to_unicode[c-0x80], t, if (p < end) *p++ = t;);