This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new dcc18b6077 avformat/mov: bound the iref thmb/cdsc entry count by the
sub-box size
dcc18b6077 is described below
commit dcc18b60779b0d228b37621b6485cb74b2d6f352
Author: Omkhar Arasaratnam <[email protected]>
AuthorDate: Tue Jun 30 21:58:38 2026 +0200
Commit: michaelni <[email protected]>
CommitDate: Sun Jul 5 02:20:37 2026 +0000
avformat/mov: bound the iref thmb/cdsc entry count by the sub-box size
Fixes: excessive parsing past the iref sub-box
Fixes: TMwMAJfgy3l9
Fixes: 74e430202d933284fc38b591d4b3a12464e8aec6 (avformat/mov: make items
referencing items generic)
Found-by: Omkhar Arasaratnam
Signed-off-by: Michael Niedermayer <[email protected]>
---
libavformat/mov.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 90b01f9499..4154038d9e 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -9444,10 +9444,11 @@ fail:
return ret;
}
-static int mov_read_iref_cdsc(MOVContext *c, AVIOContext *pb, uint32_t type,
int version)
+static int mov_read_iref_cdsc(MOVContext *c, AVIOContext *pb, uint32_t type,
int version, uint32_t size)
{
HEIFItem *from_item = NULL;
int entries;
+ int item_id_size = version ? 4 : 2;
int from_item_id = version ? avio_rb32(pb) : avio_rb16(pb);
const HEIFItemRef ref = { type, from_item_id };
@@ -9458,6 +9459,11 @@ static int mov_read_iref_cdsc(MOVContext *c, AVIOContext
*pb, uint32_t type, int
}
entries = avio_rb16(pb);
+ if ((int64_t)entries * item_id_size > (int64_t)size - item_id_size - 2) {
+ av_log(c->fc, AV_LOG_ERROR, "iref %s entry count %d exceeds the
sub-box size\n",
+ av_fourcc2str(type), entries);
+ return AVERROR_INVALIDDATA;
+ }
/* 'to' item ids */
for (int i = 0; i < entries; i++) {
HEIFItem *item = get_heif_item(c, version ? avio_rb32(pb) :
avio_rb16(pb));
@@ -9496,13 +9502,13 @@ static int mov_read_iref(MOVContext *c, AVIOContext
*pb, MOVAtom atom)
}
while (atom.size) {
- uint32_t type, size = avio_rb32(pb);
int64_t next = avio_tell(pb);
+ uint32_t type, size = avio_rb32(pb);
- if (size < 14 || next < 0 || next > INT64_MAX - size)
+ if (size < 14 || size > atom.size || next > INT64_MAX - size)
return AVERROR_INVALIDDATA;
- next += size - 4;
+ next += size;
type = avio_rl32(pb);
switch (type) {
case MKTAG('d','i','m','g'):
@@ -9512,7 +9518,7 @@ static int mov_read_iref(MOVContext *c, AVIOContext *pb,
MOVAtom atom)
break;
case MKTAG('c','d','s','c'):
case MKTAG('t','h','m','b'):
- ret = mov_read_iref_cdsc(c, pb, type, version);
+ ret = mov_read_iref_cdsc(c, pb, type, version, size - 8);
if (ret < 0)
return ret;
break;
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
