ffmpeg | branch: master | Michael Niedermayer <mich...@niedermayer.cc> | Thu Jul 28 14:42:43 2022 +0200| [c953baa084607dd1d84c3bfcce3cf6a87c3e6e05] | committer: Michael Niedermayer
avformat/mov: Check count sums in build_open_gop_key_points() Fixes: ffmpeg.md Fixes: Out of array access Fixes: CVE-2022-2566 Found-by: Andy Nguyen <thef...@google.com> Found-by: 3pvd <3...@google.com> Reviewed-by: Andy Nguyen <thef...@google.com> Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c953baa084607dd1d84c3bfcce3cf6a87c3e6e05 --- libavformat/mov.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 1d8c5b2904..35e2271b14 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -3967,8 +3967,11 @@ static int build_open_gop_key_points(AVStream *st) /* Build an unrolled index of the samples */ sc->sample_offsets_count = 0; - for (uint32_t i = 0; i < sc->ctts_count; i++) + for (uint32_t i = 0; i < sc->ctts_count; i++) { + if (sc->ctts_data[i].count > INT_MAX - sc->sample_offsets_count) + return AVERROR(ENOMEM); sc->sample_offsets_count += sc->ctts_data[i].count; + } av_freep(&sc->sample_offsets); sc->sample_offsets = av_calloc(sc->sample_offsets_count, sizeof(*sc->sample_offsets)); if (!sc->sample_offsets) @@ -3987,8 +3990,11 @@ static int build_open_gop_key_points(AVStream *st) /* Build a list of open-GOP key samples */ sc->open_key_samples_count = 0; for (uint32_t i = 0; i < sc->sync_group_count; i++) - if (sc->sync_group[i].index == cra_index) + if (sc->sync_group[i].index == cra_index) { + if (sc->sync_group[i].count > INT_MAX - sc->open_key_samples_count) + return AVERROR(ENOMEM); sc->open_key_samples_count += sc->sync_group[i].count; + } av_freep(&sc->open_key_samples); sc->open_key_samples = av_calloc(sc->open_key_samples_count, sizeof(*sc->open_key_samples)); if (!sc->open_key_samples) @@ -3999,6 +4005,8 @@ static int build_open_gop_key_points(AVStream *st) if (sg->index == cra_index) for (uint32_t j = 0; j < sg->count; j++) sc->open_key_samples[k++] = sample_id; + if (sg->count > INT_MAX - sample_id) + return AVERROR_PATCHWELCOME; sample_id += sg->count; } _______________________________________________ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
