mirror of https://git.ffmpeg.org/ffmpeg.git
avformat/mov: Check sample size
Fixes integer overflow Fixes: poc.mp4 Found-by: ajax secure <ajax4sec@hotmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
parent
2bdb26b4ee
commit
8a3221cc67
|
@ -2843,7 +2843,12 @@ static void mov_build_index(MOVContext *mov, AVStream *st)
|
||||||
sample_size = sc->stsz_sample_size > 0 ? sc->stsz_sample_size : sc->sample_sizes[current_sample];
|
sample_size = sc->stsz_sample_size > 0 ? sc->stsz_sample_size : sc->sample_sizes[current_sample];
|
||||||
if (sc->pseudo_stream_id == -1 ||
|
if (sc->pseudo_stream_id == -1 ||
|
||||||
sc->stsc_data[stsc_index].id - 1 == sc->pseudo_stream_id) {
|
sc->stsc_data[stsc_index].id - 1 == sc->pseudo_stream_id) {
|
||||||
AVIndexEntry *e = &st->index_entries[st->nb_index_entries++];
|
AVIndexEntry *e;
|
||||||
|
if (sample_size > 0x3FFFFFFF) {
|
||||||
|
av_log(mov->fc, AV_LOG_ERROR, "Sample size %u is too large\n", sample_size);
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
e = &st->index_entries[st->nb_index_entries++];
|
||||||
e->pos = current_offset;
|
e->pos = current_offset;
|
||||||
e->timestamp = current_dts;
|
e->timestamp = current_dts;
|
||||||
e->size = sample_size;
|
e->size = sample_size;
|
||||||
|
@ -2968,6 +2973,10 @@ static void mov_build_index(MOVContext *mov, AVStream *st)
|
||||||
av_log(mov->fc, AV_LOG_ERROR, "wrong chunk count %d\n", total);
|
av_log(mov->fc, AV_LOG_ERROR, "wrong chunk count %d\n", total);
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
if (size > 0x3FFFFFFF) {
|
||||||
|
av_log(mov->fc, AV_LOG_ERROR, "Sample size %u is too large\n", size);
|
||||||
|
return;
|
||||||
|
}
|
||||||
e = &st->index_entries[st->nb_index_entries++];
|
e = &st->index_entries[st->nb_index_entries++];
|
||||||
e->pos = current_offset;
|
e->pos = current_offset;
|
||||||
e->timestamp = current_dts;
|
e->timestamp = current_dts;
|
||||||
|
|
Loading…
Reference in New Issue