Signed-off-by: Dale Curtis <dalecur...@chromium.org>
---
libavformat/mov.c | 4 ++++
1 file changed, 4 insertions(+)
From 3cd1ecb83c4b100bef99d9cd23d0066f0ad3cc5c Mon Sep 17 00:00:00 2001
From: Dale Curtis <dalecurtis@chromium.org>
Date: Thu, 14 May 2020 14:57:08 -0700
Subject: [PATCH 5/5] [mov] Don't allow negative sample sizes.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org>
---
libavformat/mov.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 6c74d6fe23..57f33e69d2 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -2902,6 +2902,10 @@ static int mov_read_stsz(MOVContext *c, AVIOContext *pb, MOVAtom atom)
for (i = 0; i < entries && !pb->eof_reached; i++) {
sc->sample_sizes[i] = get_bits_long(&gb, field_size);
+ if (sc->sample_sizes[i] < 0) {
+ av_log(c->fc, AV_LOG_ERROR, "Invalid sample size %d\n", sc->sample_sizes[i]);
+ return AVERROR_INVALIDDATA;
+ }
sc->data_size += sc->sample_sizes[i];
}
--
2.26.2.761.g0e0b3e54be-goog
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
