ffmpeg | branch: release/7.0 | James Almer <jamr...@gmail.com> | Sun Jun 30 23:40:22 2024 -0300| [28b1dbb4ee23e471bb1f8e6e6e6a46ce59a2dcce] | committer: James Almer
avformat/mov: add more checks for infe atom size Signed-off-by: James Almer <jamr...@gmail.com> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=28b1dbb4ee23e471bb1f8e6e6e6a46ce59a2dcce --- libavformat/mov.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavformat/mov.c b/libavformat/mov.c index 2c47610d0e..be8add7603 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -8132,6 +8132,8 @@ static int mov_read_infe(MOVContext *c, AVIOContext *pb, MOVAtom atom, int idx) version = avio_r8(pb); avio_rb24(pb); // flags. size -= 4; + if (size < 0) + return AVERROR_INVALIDDATA; if (version < 2) { avpriv_report_missing_feature(c->fc, "infe version < 2"); @@ -8143,6 +8145,8 @@ static int mov_read_infe(MOVContext *c, AVIOContext *pb, MOVAtom atom, int idx) avio_rb16(pb); // item_protection_index item_type = avio_rl32(pb); size -= 8; + if (size < 1) + return AVERROR_INVALIDDATA; av_bprint_init(&item_name, 0, AV_BPRINT_SIZE_UNLIMITED); ret = ff_read_string_to_bprint_overwrite(pb, &item_name, size); _______________________________________________ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
