RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

lavf/mov.c: Avoid heap allocation wrap in mov_read_uuid 

Core of patch is from paul@paulmehta.com
Reference https://crbug.com/643951

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Check value reduced as the code does not support values beyond INT_MAX
Also the check is moved to a more common place and before integer truncation

(cherry picked from commit 2d453188c2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Matt Wolenetz 2016-12-14 15:26:19 -08:00 committed by Michael Niedermayer
parent bb7fd51239
commit 01308b492a
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libavformat/mov.c
View File

@ -3092,7 +3092,7 @@ static int mov_read_uuid(MOVContext *c, AVIOContext *pb, MOVAtom atom)
0xba, 0x2f, 0x08, 0x00, 0x20, 0x0c, 0x9a, 0x66 0xba, 0x2f, 0x08, 0x00, 0x20, 0x0c, 0x9a, 0x66
}; };
if (atom.size < sizeof(uuid) || atom.size == INT64_MAX) if (atom.size < sizeof(uuid) || atom.size >= FFMIN(INT_MAX, SIZE_MAX))
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
ret = avio_read(pb, uuid, sizeof(uuid)); ret = avio_read(pb, uuid, sizeof(uuid));