virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-11-26 19:01:44 +02:00
Code Issues Releases Activity

avformat/matroskaenc: Fix and simplify check for invalid crop values

Browse Source 
The check "left >= INT_MAX - right" is supposed to check for
whether left + right does not overflow/wraparound, but given that
left and top are uint32_t INT_MAX - right can already wraparound
for big values of right (and ordinary 32-bit ints):
If right == UINT32_MAX, INT_MAX - right is INT_MAX + 1;
for left in 0..par->width both checks will be passed.

Fix this and simplify the check by using 64-bit types,
where the addition is guaranteed not to overflow.

Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
This commit is contained in:
Andreas Rheinhardt 2024-07-08 19:12:26 +02:00
parent 8765b36a52
commit 9ffac78eba
1 changed files with 2 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libavformat/matroskaenc.c
View File

@ -1786,16 +1786,14 @@ static int mkv_write_track_video(AVFormatContext *s, MatroskaMuxContext *mkv,
st->codecpar->nb_coded_side_data,
AV_PKT_DATA_FRAME_CROPPING);
if (sd && sd->size == sizeof(uint32_t) * 4) {
uint32_t top, bottom, left, right;
uint64_t top, bottom, left, right;
top = AV_RL32(sd->data + 0);
bottom = AV_RL32(sd->data + 4);
left = AV_RL32(sd->data + 8);
right = AV_RL32(sd->data + 12);
if (left >= INT_MAX - right ||
top >= INT_MAX - bottom ||
(left + right) >= par->width ||
if ((left + right) >= par->width ||
(top + bottom) >= par->height) {
av_log(s, AV_LOG_ERROR, "Invalid cropping dimensions in stream side data\n");
return AVERROR(EINVAL);