RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avformat/mov: Check sample size 

Fixes integer overflow
Fixes: poc.mp4

Found-by: ajax secure <ajax4sec@hotmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2016-06-28 23:49:36 +02:00
parent 2bdb26b4ee
commit 8a3221cc67
1 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
libavformat/mov.c
View File

@ -2843,7 +2843,12 @@ static void mov_build_index(MOVContext *mov, AVStream *st)
sample_size = sc->stsz_sample_size > 0 ? sc->stsz_sample_size : sc->sample_sizes[current_sample];
if (sc->pseudo_stream_id == -1 ||
sc->stsc_data[stsc_index].id - 1 == sc->pseudo_stream_id) {
AVIndexEntry *e = &st->index_entries[st->nb_index_entries++];
AVIndexEntry *e;
if (sample_size > 0x3FFFFFFF) {
av_log(mov->fc, AV_LOG_ERROR, "Sample size %u is too large\n", sample_size);
return;
}
e = &st->index_entries[st->nb_index_entries++];
e->pos = current_offset;
e->timestamp = current_dts;
e->size = sample_size;
@ -2968,6 +2973,10 @@ static void mov_build_index(MOVContext *mov, AVStream *st)
av_log(mov->fc, AV_LOG_ERROR, "wrong chunk count %d\n", total);
return;
}
if (size > 0x3FFFFFFF) {
av_log(mov->fc, AV_LOG_ERROR, "Sample size %u is too large\n", size);
return;
}
e = &st->index_entries[st->nb_index_entries++];
e->pos = current_offset;
e->timestamp = current_dts;