diff options
| author | Dale Curtis <dalecurtis@chromium.org> | 2018-08-30 15:18:25 -0700 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2018-09-01 19:26:40 +0200 |
| commit | 320b631a99a9f759fd1d5460fd4e285d184b8186 (patch) | |
| tree | f611ff72d1b9e86c510788e2b8c8a26b5d036c9f /libavformat/mov.c | |
| parent | a82e4fb8c6f26e75506df6818fee1b61f940cbeb (diff) | |
avformat/mov: Error on too large stsd entry counts.
Entries are always at least 8 bytes per the parsing code, so if we
see an impossible entry count avoid massive allocations. This is
similar to an existing check in mov_read_stsc().
Since ff_mov_read_stsd_entries() does eof checks, an alternative
approach could be to clamp the entry count to atom.size / 8.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavformat/mov.c')
| -rw-r--r-- | libavformat/mov.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/libavformat/mov.c b/libavformat/mov.c index d66f4e338c..d922e0f173 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -2558,7 +2558,8 @@ static int mov_read_stsd(MOVContext *c, AVIOContext *pb, MOVAtom atom) avio_rb24(pb); /* flags */ entries = avio_rb32(pb); - if (entries <= 0) { + /* Each entry contains a size (4 bytes) and format (4 bytes). */ + if (entries <= 0 || entries > atom.size / 8) { av_log(c->fc, AV_LOG_ERROR, "invalid STSD entries %d\n", entries); return AVERROR_INVALIDDATA; } |