From: Zhang Xiaohui <ruc_zhangxiao...@163.com>
Hi, I think function mov_read_cmov fails to perform proper bounds
checking on cmov_len, which may lead to invalid memory allocation.
Signed-off-by: Zhang Xiaohui <ruc_zhangxiao...@163.com>
---
libavformat/mov.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 7fd43a8fc5..a23daa25da 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -5183,6 +5183,8 @@ static int mov_read_cmov(MOVContext *c, AVIOContext *pb,
MOVAtom atom)
moov_len = avio_rb32(pb); /* uncompressed size */
cmov_len = atom.size - 6 * 4;
+ if (cmov_len <= 0)
+ return AVERROR_INVALIDDATA;
cmov_data = av_malloc(cmov_len);
if (!cmov_data)
return AVERROR(ENOMEM);
--
2.17.1
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
