virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-06-14 08:44:40 +02:00
Code Issues Releases Activity

avformat/mov: Limit maximum box size for mov_read_lhvc()

Browse Source 
Signed-off-by: Dale Curtis <dalecurtis@chromium.org>
This commit is contained in:
Dale Curtis
2026-04-22 20:19:02 +00:00
committed by James Almer
parent e294b390a0
commit a7d42bfba8
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libavformat/mov.c
+3 -1
View File
@@ -8683,8 +8683,10 @@ static int mov_read_lhvc(MOVContext *c, AVIOContext *pb, MOVAtom atom)
// TODO: handle lhvC when present before hvcC
return 0;
if (atom.size < 6 || st->codecpar->extradata_size < 23)
if (atom.size < 6 || st->codecpar->extradata_size < 23 ||
atom.size > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE) {
return AVERROR_INVALIDDATA;
}
buf = av_malloc(atom.size + AV_INPUT_BUFFER_PADDING_SIZE);
if (!buf)