RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avformat/mov: Check STSC and remove invalid entries 

Fixes assertion failure
Fixes: crbug 822547, crbug 822666 and crbug 823009

Affects: aark15sd_9A62E2FA.mp4

Found-by: ClusterFuzz
Reviewed-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2018-03-16 19:53:36 +01:00
parent f6ea397d0a
commit 9e67447a4f
1 changed files with 20 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
libavformat/mov.c
View File

@ -2630,6 +2630,21 @@ static int mov_read_stsc(MOVContext *c, AVIOContext *pb, MOVAtom atom)
}
sc->stsc_count = i;
for (i = sc->stsc_count - 1; i < UINT_MAX; i--) {
if ((i+1 < sc->stsc_count && sc->stsc_data[i].first >= sc->stsc_data[i+1].first) ||
(i > 0 && sc->stsc_data[i].first <= sc->stsc_data[i-1].first) ||
sc->stsc_data[i].first < 1 ||
sc->stsc_data[i].count < 1 ||
sc->stsc_data[i].id < 1) {
av_log(c->fc, AV_LOG_WARNING, "STSC entry %d is invalid (first=%d count=%d id=%d)\n", i, sc->stsc_data[i].first, sc->stsc_data[i].count, sc->stsc_data[i].id);
if (i+1 >= sc->stsc_count || sc->stsc_data[i+1].first < 2)
return AVERROR_INVALIDDATA;
// We replace this entry by the next valid
sc->stsc_data[i].first = sc->stsc_data[i+1].first - 1;
sc->stsc_data[i].count = sc->stsc_data[i+1].count;
sc->stsc_data[i].id = sc->stsc_data[i+1].id;
}
}
if (pb->eof_reached) {
av_log(c->fc, AV_LOG_WARNING, "reached eof, corrupted STSC atom\n");
@ -4119,6 +4134,11 @@ static int mov_read_trak(MOVContext *c, AVIOContext *pb, MOVAtom atom)
st->index);
return 0;
}
if (sc->stsc_count && sc->stsc_data[ sc->stsc_count - 1 ].first > sc->chunk_count) {
av_log(c->fc, AV_LOG_ERROR, "stream %d, contradictionary STSC and STCO\n",
st->index);
return AVERROR_INVALIDDATA;
}
fix_timescale(c, sc);