diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2022-07-28 14:42:43 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2022-08-28 22:06:45 +0200 |
| commit | c953baa084607dd1d84c3bfcce3cf6a87c3e6e05 (patch) | |
| tree | 863e5a121c2196ac1918bac2fef7f926c7335a8e /libavformat | |
| parent | ced0dc807eb67516b341d68f04ce5a87b02820de (diff) | |
avformat/mov: Check count sums in build_open_gop_key_points()
Fixes: ffmpeg.md
Fixes: Out of array access
Fixes: CVE-2022-2566
Found-by: Andy Nguyen <theflow@google.com>
Found-by: 3pvd <3pvd@google.com>
Reviewed-by: Andy Nguyen <theflow@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavformat')
| -rw-r--r-- | libavformat/mov.c | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/libavformat/mov.c b/libavformat/mov.c index 1d8c5b2904..35e2271b14 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -3967,8 +3967,11 @@ static int build_open_gop_key_points(AVStream *st) /* Build an unrolled index of the samples */ sc->sample_offsets_count = 0; - for (uint32_t i = 0; i < sc->ctts_count; i++) + for (uint32_t i = 0; i < sc->ctts_count; i++) { + if (sc->ctts_data[i].count > INT_MAX - sc->sample_offsets_count) + return AVERROR(ENOMEM); sc->sample_offsets_count += sc->ctts_data[i].count; + } av_freep(&sc->sample_offsets); sc->sample_offsets = av_calloc(sc->sample_offsets_count, sizeof(*sc->sample_offsets)); if (!sc->sample_offsets) @@ -3987,8 +3990,11 @@ static int build_open_gop_key_points(AVStream *st) /* Build a list of open-GOP key samples */ sc->open_key_samples_count = 0; for (uint32_t i = 0; i < sc->sync_group_count; i++) - if (sc->sync_group[i].index == cra_index) + if (sc->sync_group[i].index == cra_index) { + if (sc->sync_group[i].count > INT_MAX - sc->open_key_samples_count) + return AVERROR(ENOMEM); sc->open_key_samples_count += sc->sync_group[i].count; + } av_freep(&sc->open_key_samples); sc->open_key_samples = av_calloc(sc->open_key_samples_count, sizeof(*sc->open_key_samples)); if (!sc->open_key_samples) @@ -3999,6 +4005,8 @@ static int build_open_gop_key_points(AVStream *st) if (sg->index == cra_index) for (uint32_t j = 0; j < sg->count; j++) sc->open_key_samples[k++] = sample_id; + if (sg->count > INT_MAX - sample_id) + return AVERROR_PATCHWELCOME; sample_id += sg->count; } |