RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

matroskadec: add generic element length validation. 

This validate the length of a mkv element directly after reading
it.
This has the advantage that it is easy to add new limits and makes
it less likely to forget to add checks and also avoids issues like
bits of the length value above the first 32 being ignored because
the parsing functions only takes an int.
Previously discussed in the "mkv 0-byte integer parsing" thread.

Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
(cherry picked from commit 95ec3d4cac)
This commit is contained in:
Reimar Döffinger 2011-02-06 11:32:03 +01:00 committed by Michael Niedermayer
parent cb9f7fd34c
commit 14d735bd4f
1 changed files with 17 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
libavformat/matroskadec.c
View File

@ -58,6 +58,7 @@ typedef enum {
EBML_NEST,
EBML_PASS,
EBML_STOP,
EBML_TYPE_COUNT
} EbmlType;
typedef const struct EbmlSyntax {
@ -780,6 +781,16 @@ static int ebml_parse_nest(MatroskaDemuxContext *matroska, EbmlSyntax *syntax,
static int ebml_parse_elem(MatroskaDemuxContext *matroska,
EbmlSyntax *syntax, void *data)
{
static const uint64_t max_lengths[EBML_TYPE_COUNT] = {
[EBML_UINT] = 8,
[EBML_FLOAT] = 8,
// max. 16 MB for strings
[EBML_STR] = 0x1000000,
[EBML_UTF8] = 0x1000000,
// max. 256 MB for binary data
[EBML_BIN] = 0x10000000,
// no limits for anything else
};
ByteIOContext *pb = matroska->ctx->pb;
uint32_t id = syntax->id;
uint64_t length;
@ -798,6 +809,12 @@ static int ebml_parse_elem(MatroskaDemuxContext *matroska,
matroska->current_id = 0;
if ((res = ebml_read_length(matroska, pb, &length)) < 0)
return res;
if (max_lengths[syntax->type] && length > max_lengths[syntax->type]) {
av_log(matroska->ctx, AV_LOG_ERROR,
"Invalid length 0x%"PRIx64" > 0x%"PRIx64" for syntax element %i\n",
length, max_lengths[syntax->type], syntax->type);
return AVERROR_INVALIDDATA;
}
}
switch (syntax->type) {