ffmpeg | branch: release/2.8 | Matt Wolenetz <[email protected]> | Wed Dec 14 15:26:19 2016 -0800| [4adc99ecb6e9aec301fdd79ec097d433346045b6] | committer: Michael Niedermayer
lavf/mov.c: Avoid heap allocation wrap in mov_read_uuid Core of patch is from [email protected] Reference https://crbug.com/643951 Signed-off-by: Michael Niedermayer <[email protected]> Check value reduced as the code does not support values beyond INT_MAX Also the check is moved to a more common place and before integer truncation (cherry picked from commit 2d453188c2303da641dafb048dc1806790526dfd) Signed-off-by: Michael Niedermayer <[email protected]> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4adc99ecb6e9aec301fdd79ec097d433346045b6 --- libavformat/mov.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 44909e3..017df0f 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -3810,7 +3810,7 @@ static int mov_read_uuid(MOVContext *c, AVIOContext *pb, MOVAtom atom) 0xba, 0x2f, 0x08, 0x00, 0x20, 0x0c, 0x9a, 0x66 }; - if (atom.size < sizeof(uuid) || atom.size == INT64_MAX) + if (atom.size < sizeof(uuid) || atom.size >= FFMIN(INT_MAX, SIZE_MAX)) return AVERROR_INVALIDDATA; ret = avio_read(pb, uuid, sizeof(uuid)); _______________________________________________ ffmpeg-cvslog mailing list [email protected] http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
