virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-11-21 10:55:51 +02:00
Code Issues Releases Activity

avformat/mov: Check count sums in build_open_gop_key_points()

Browse Source 
Fixes: ffmpeg.md
Fixes: Out of array access
Fixes: CVE-2022-2566

Found-by: Andy Nguyen <theflow@google.com>
Found-by: 3pvd <3pvd@google.com>
Reviewed-by: Andy Nguyen <theflow@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2022-07-28 14:42:43 +02:00
parent ced0dc807e
commit c953baa084
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
libavformat/mov.c
View File

@ -3967,8 +3967,11 @@ static int build_open_gop_key_points(AVStream *st)
/* Build an unrolled index of the samples */
sc->sample_offsets_count = 0;
for (uint32_t i = 0; i < sc->ctts_count; i++)
for (uint32_t i = 0; i < sc->ctts_count; i++) {
if (sc->ctts_data[i].count > INT_MAX - sc->sample_offsets_count)
return AVERROR(ENOMEM);
sc->sample_offsets_count += sc->ctts_data[i].count;
}
av_freep(&sc->sample_offsets);
sc->sample_offsets = av_calloc(sc->sample_offsets_count, sizeof(*sc->sample_offsets));
if (!sc->sample_offsets)
@ -3987,8 +3990,11 @@ static int build_open_gop_key_points(AVStream *st)
/* Build a list of open-GOP key samples */
sc->open_key_samples_count = 0;
for (uint32_t i = 0; i < sc->sync_group_count; i++)
if (sc->sync_group[i].index == cra_index)
if (sc->sync_group[i].index == cra_index) {
if (sc->sync_group[i].count > INT_MAX - sc->open_key_samples_count)
return AVERROR(ENOMEM);
sc->open_key_samples_count += sc->sync_group[i].count;
}
av_freep(&sc->open_key_samples);
sc->open_key_samples = av_calloc(sc->open_key_samples_count, sizeof(*sc->open_key_samples));
if (!sc->open_key_samples)
@ -3999,6 +4005,8 @@ static int build_open_gop_key_points(AVStream *st)
if (sg->index == cra_index)
for (uint32_t j = 0; j < sg->count; j++)
sc->open_key_samples[k++] = sample_id;
if (sg->count > INT_MAX - sample_id)
return AVERROR_PATCHWELCOME;
sample_id += sg->count;
}