RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avformat/mov: check offset for overflow in mov_probe() 

Fixes: Invalid read of size 4
Fixes: ASAN_Deadlysignal.zip

Found-by: Hardik Shah <hardik05@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0f6a3405e8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2021-04-04 21:01:46 +02:00
parent 2a7f1bc282
commit d22550dd61
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libavformat/mov.c
View File

@ -7122,7 +7122,7 @@ static int mov_probe(const AVProbeData *p)
int64_t size;
int minsize = 8;
/* ignore invalid offset */
if ((offset + 8) > (unsigned int)p->buf_size)
if ((offset + 8ULL) > (unsigned int)p->buf_size)
break;
size = AV_RB32(p->buf + offset);
if (size == 1 && offset + 16 <= (unsigned int)p->buf_size) {
@ -7169,6 +7169,8 @@ static int mov_probe(const AVProbeData *p)
score = FFMAX(score, AVPROBE_SCORE_EXTENSION);
break;
}
if (size > INT64_MAX - offset)
break;
offset += size;
}
if (score > AVPROBE_SCORE_MAX - 50 && moov_offset != -1) {