ffmpeg | branch: release/2.2 | Dale Curtis <[email protected]> | Mon Jan 5 16:19:09 2015 -0800| [57710c3646d4e0edb9e66ecf059d29df172a4187] | committer: Michael Niedermayer
mov: Avoid overflow with mov_metadata_raw() The code previously added 1 to len without checking its size, resulting in an overflow which can corrupt value[-1] -- which may be used to store unaligned ptr information for certain allocators. Found-by: Paul Mehta <[email protected]> Signed-off-by: Dale Curtis <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=57710c3646d4e0edb9e66ecf059d29df172a4187 --- libavformat/mov.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavformat/mov.c b/libavformat/mov.c index f0d095e..0d4017b 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -279,6 +279,9 @@ static int mov_read_covr(MOVContext *c, AVIOContext *pb, int type, int len) static int mov_metadata_raw(MOVContext *c, AVIOContext *pb, unsigned len, const char *key) { + // Check for overflow. + if (len >= INT_MAX) + return AVERROR(EINVAL); char *value = av_malloc(len + 1); if (!value) return AVERROR(ENOMEM); _______________________________________________ ffmpeg-cvslog mailing list [email protected] http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
