RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avformat/mov: fix integer overflow of size 

Fixes: case1_call_stack_overflow.mp4
Found-by: Michal Zalewski <lcamtuf@coredump.cx>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit be9ce6e10a)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2014-12-16 21:29:27 +01:00
parent d85e25fe0b
commit 4400385d5f
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libavformat/mov.c
View File

@ -1550,7 +1550,7 @@ static void mov_parse_stsd_audio(MOVContext *c, AVIOContext *pb,
static void mov_parse_stsd_subtitle(MOVContext *c, AVIOContext *pb,
AVStream *st, MOVStreamContext *sc,
int size)
int64_t size)
{
// ttxt stsd contains display flags, justification, background
// color, fonts, and default styles, so fake an atom to read it
@ -1615,10 +1615,10 @@ static int mov_rewrite_dvd_sub_extradata(AVStream *st)
static int mov_parse_stsd_data(MOVContext *c, AVIOContext *pb,
AVStream *st, MOVStreamContext *sc,
int size)
int64_t size)
{
if (st->codec->codec_tag == MKTAG('t','m','c','d')) {
if (ff_get_extradata(st->codec, pb, size) < 0)
if ((int)size != size || ff_get_extradata(st->codec, pb, size) < 0)
return AVERROR(ENOMEM);
if (size > 16) {
MOVStreamContext *tmcd_ctx = st->priv_data;