RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avformat/movenc: check that reel_name length doesn't exceed UINT16_MAX 

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Mark Reid 2014-08-10 12:01:33 -07:00 committed by Michael Niedermayer
parent bd87965247
commit cab39afb1a
1 changed files with 12 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
libavformat/movenc.c
View File

@ -1340,13 +1340,22 @@ static int mov_write_rtp_tag(AVIOContext *pb, MOVTrack *track)
return update_size(pb, pos);
}
static int mov_write_source_reference_tag(AVIOContext *pb, MOVTrack *track, const char *reel_name){
static int mov_write_source_reference_tag(AVIOContext *pb, MOVTrack *track, const char *reel_name)
{
uint64_t str_size =strlen(reel_name);
int64_t pos = avio_tell(pb);
if (str_size >= UINT16_MAX){
av_log(NULL, AV_LOG_ERROR, "reel_name length %llu is too large\n", str_size);
avio_wb16(pb, 0);
return AVERROR(EINVAL);
}
avio_wb32(pb, 0); /* size */
ffio_wfourcc(pb, "name"); /* Data format */
avio_wb16(pb, strlen(reel_name)); /* string size */
avio_wb16(pb, str_size); /* string size */
avio_wb16(pb, track->language); /* langcode */
avio_write(pb, reel_name, strlen(reel_name)); /* reel name */
avio_write(pb, reel_name, str_size); /* reel name */
return update_size(pb,pos);
}