RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2024-12-26 17:32:06 +00:00
Code Issues Projects Releases Wiki Activity

avformat/mov: Fix extended atom size buffer length check

Browse Source 
When extended atom size support was added to probing in
fec4a2d232, the buffer
size check was backwards, but probing continued to work
because there was no minimum size check yet, so despite
size being 1 on these atoms, and failing to read the 64-bit
size, the tag was still correctly read.

When 0b78016b2d introduced a
minimum size check, this exposed the bug, and broke probing
any files with extended atom sizes, such as entirely valid
large files that start whith mdat atoms.

Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
This commit is contained in:
Derek Buitenhuis 2021-03-18 15:26:54 +00:00
parent 75fd3e1519
commit 85f397c828
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libavformat/mov.c
View File

@ -7121,7 +7121,7 @@ static int mov_probe(const AVProbeData *p)
if ((offset + 8) > (unsigned int)p->buf_size) if ((offset + 8) > (unsigned int)p->buf_size)
break; break;
size = AV_RB32(p->buf + offset); size = AV_RB32(p->buf + offset);
if (size == 1 && offset + 16 > (unsigned int)p->buf_size) { if (size == 1 && offset + 16 <= (unsigned int)p->buf_size) {
size = AV_RB64(p->buf+offset + 8); size = AV_RB64(p->buf+offset + 8);
minsize = 16; minsize = 16;
} else if (size == 0) { } else if (size == 0) {