virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-07-16 22:42:38 +02:00
Code Issues Releases Activity

avformat/mov: add more checks for infe atom size

Browse Source 
Signed-off-by: James Almer <jamrial@gmail.com>
This commit is contained in:
James Almer
2024-06-30 23:40:22 -03:00
parent 235ba14cc0
commit cf7e2c5e05
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
libavformat/mov.c
View File

@ -8484,6 +8484,8 @@ static int mov_read_infe(MOVContext *c, AVIOContext *pb, MOVAtom atom, int idx)
version = avio_r8(pb); version = avio_r8(pb);
avio_rb24(pb); // flags. avio_rb24(pb); // flags.
size -= 4; size -= 4;
if (size < 0)
return AVERROR_INVALIDDATA;
if (version < 2) { if (version < 2) {
avpriv_report_missing_feature(c->fc, "infe version < 2"); avpriv_report_missing_feature(c->fc, "infe version < 2");
@ -8495,6 +8497,8 @@ static int mov_read_infe(MOVContext *c, AVIOContext *pb, MOVAtom atom, int idx)
avio_rb16(pb); // item_protection_index avio_rb16(pb); // item_protection_index
item_type = avio_rl32(pb); item_type = avio_rl32(pb);
size -= 8; size -= 8;
if (size < 1)
return AVERROR_INVALIDDATA;
av_bprint_init(&item_name, 0, AV_BPRINT_SIZE_UNLIMITED); av_bprint_init(&item_name, 0, AV_BPRINT_SIZE_UNLIMITED);
ret = ff_read_string_to_bprint_overwrite(pb, &item_name, size); ret = ff_read_string_to_bprint_overwrite(pb, &item_name, size);