ffmpeg | branch: release/2.8 | Matt Wolenetz <wolen...@google.com> | Wed Dec 14 15:24:42 2016 -0800| [8be3724e55b2c55337c14c9cb7a69c5a85d42a65] | committer: Michael Niedermayer
lavf/mov.c: Avoid heap allocation wrap in mov_read_hdlr Core of patch is from p...@paulmehta.com Reference https://crbug.com/643950 Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> Check value reduced as the code does not support larger lengths (cherry picked from commit fd30e4d57fe5841385f845440688505b88c0f4a9) Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=8be3724e55b2c55337c14c9cb7a69c5a85d42a65 --- libavformat/mov.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavformat/mov.c b/libavformat/mov.c index aa62087..44909e3 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -635,6 +635,8 @@ static int mov_read_hdlr(MOVContext *c, AVIOContext *pb, MOVAtom atom) title_size = atom.size - 24; if (title_size > 0) { + if (title_size > FFMIN(INT_MAX, SIZE_MAX-1)) + return AVERROR_INVALIDDATA; title_str = av_malloc(title_size + 1); /* Add null terminator */ if (!title_str) return AVERROR(ENOMEM); _______________________________________________ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
