mirror of https://git.ffmpeg.org/ffmpeg.git
mov: validate number of DataReferenceBox entries against box size
Avoids a 2G memory allocation and parsing of random data in mov_read_dref(). The fuzzed sample sample.mp4_s224424 triggers this.
This commit is contained in:
parent
80b6b31417
commit
8cc2fa1e5d
|
@ -351,6 +351,7 @@ static int mov_read_chpl(MOVContext *c, AVIOContext *pb, MOVAtom atom)
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
#define MIN_DATA_ENTRY_BOX_SIZE 12
|
||||||
static int mov_read_dref(MOVContext *c, AVIOContext *pb, MOVAtom atom)
|
static int mov_read_dref(MOVContext *c, AVIOContext *pb, MOVAtom atom)
|
||||||
{
|
{
|
||||||
AVStream *st;
|
AVStream *st;
|
||||||
|
@ -364,7 +365,8 @@ static int mov_read_dref(MOVContext *c, AVIOContext *pb, MOVAtom atom)
|
||||||
|
|
||||||
avio_rb32(pb); // version + flags
|
avio_rb32(pb); // version + flags
|
||||||
entries = avio_rb32(pb);
|
entries = avio_rb32(pb);
|
||||||
if (entries >= UINT_MAX / sizeof(*sc->drefs))
|
if (entries > (atom.size - 1) / MIN_DATA_ENTRY_BOX_SIZE + 1 ||
|
||||||
|
entries >= UINT_MAX / sizeof(*sc->drefs))
|
||||||
return AVERROR_INVALIDDATA;
|
return AVERROR_INVALIDDATA;
|
||||||
av_free(sc->drefs);
|
av_free(sc->drefs);
|
||||||
sc->drefs = av_mallocz(entries * sizeof(*sc->drefs));
|
sc->drefs = av_mallocz(entries * sizeof(*sc->drefs));
|
||||||
|
|
Loading…
Reference in New Issue