RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avutil/encryption_info: Fix size calculation. 

Found by Chrome's ClusterFuzz: https://crbug.com/873693

Signed-off-by: Jacob Trimble <modmaker@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Jacob Trimble 2018-08-13 15:17:11 -07:00 committed by Michael Niedermayer
parent f5559dd869
commit 67599812a3
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libavutil/encryption_info.c
View File

@ -297,14 +297,14 @@ uint8_t *av_encryption_init_info_add_side_data(const AVEncryptionInitInfo *info,
temp_side_data_size = 4; temp_side_data_size = 4;
init_info_count = 0; init_info_count = 0;
for (cur_info = info; cur_info; cur_info = cur_info->next) { for (cur_info = info; cur_info; cur_info = cur_info->next) {
temp_side_data_size += (uint64_t)FF_ENCRYPTION_INIT_INFO_EXTRA + info->system_id_size + info->data_size; temp_side_data_size += (uint64_t)FF_ENCRYPTION_INIT_INFO_EXTRA + cur_info->system_id_size + cur_info->data_size;
if (init_info_count == UINT32_MAX || temp_side_data_size > UINT32_MAX) { if (init_info_count == UINT32_MAX || temp_side_data_size > UINT32_MAX) {
return NULL; return NULL;
} }
init_info_count++; init_info_count++;
if (info->num_key_ids) { if (cur_info->num_key_ids) {
temp_side_data_size += (uint64_t)info->num_key_ids * info->key_id_size; temp_side_data_size += (uint64_t)cur_info->num_key_ids * cur_info->key_id_size;
if (temp_side_data_size > UINT32_MAX) { if (temp_side_data_size > UINT32_MAX) {
return NULL; return NULL;
} }