RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avformat/mov: store sample_sizes as unsigned ints 

As defined in Section 8.7.3.2.1 of ISO 14496-12.
Any unsupported value will be rejected in mov_build_index() without outright
aborting demuxing.

Fixes ticket #11005.

Signed-off-by: James Almer <jamrial@gmail.com>
This commit is contained in:
James Almer 2024-05-19 22:38:21 -03:00
parent 2d84ee3745
commit 3146b77a7d
2 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libavformat/isom.h
View File

@ -193,7 +193,7 @@ typedef struct MOVStreamContext {
unsigned int sample_size; ///< may contain value calculated from stsd or value from stsz atom
unsigned int stsz_sample_size; ///< always contains sample size from stsz atom
unsigned int sample_count;
int *sample_sizes;
unsigned int *sample_sizes;
int keyframe_absent;
unsigned int keyframe_count;
int *keyframes;

4
libavformat/mov.c
View File

@ -3308,9 +3308,9 @@ static int mov_read_stsz(MOVContext *c, AVIOContext *pb, MOVAtom atom)
for (i = 0; i < entries; i++) {
sc->sample_sizes[i] = get_bits_long(&gb, field_size);
if (sc->sample_sizes[i] < 0) {
if (sc->sample_sizes[i] > INT64_MAX - sc->data_size) {
av_free(buf);
av_log(c->fc, AV_LOG_ERROR, "Invalid sample size %d\n", sc->sample_sizes[i]);
av_log(c->fc, AV_LOG_ERROR, "Sample size overflow in STSZ\n");
return AVERROR_INVALIDDATA;
}
sc->data_size += sc->sample_sizes[i];