ffmpeg | branch: master | James Almer <jamr...@gmail.com> | Sun Jun 30 23:40:22 2024 -0300| [cf7e2c5e055b6ad4dc629fcfadb40208d164c94c] | committer: James Almer
avformat/mov: add more checks for infe atom size Signed-off-by: James Almer <jamr...@gmail.com> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=cf7e2c5e055b6ad4dc629fcfadb40208d164c94c --- libavformat/mov.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavformat/mov.c b/libavformat/mov.c index f07eab4d90..b4402d2bba 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -8484,6 +8484,8 @@ static int mov_read_infe(MOVContext *c, AVIOContext *pb, MOVAtom atom, int idx) version = avio_r8(pb); avio_rb24(pb); // flags. size -= 4; + if (size < 0) + return AVERROR_INVALIDDATA; if (version < 2) { avpriv_report_missing_feature(c->fc, "infe version < 2"); @@ -8495,6 +8497,8 @@ static int mov_read_infe(MOVContext *c, AVIOContext *pb, MOVAtom atom, int idx) avio_rb16(pb); // item_protection_index item_type = avio_rl32(pb); size -= 8; + if (size < 1) + return AVERROR_INVALIDDATA; av_bprint_init(&item_name, 0, AV_BPRINT_SIZE_UNLIMITED); ret = ff_read_string_to_bprint_overwrite(pb, &item_name, size); _______________________________________________ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
