On 4/1/2024 11:28 PM, Eugene Zemtsov via ffmpeg-devel wrote:
From: Eugene Zemtsov <eug...@chromium.org>
Stop reading keys and return AVERROR_INVALIDDATA if key_size
is larger than the amount of space left in the atom.
Bug: https://crbug.com/41496983
Signed-off-by: Eugene Zemtsov <eug...@chromium.org>
---
libavformat/mov.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 662301bf67..2d92e7963b 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -5048,12 +5048,13 @@ static int mov_read_keys(MOVContext *c, AVIOContext
*pb, MOVAtom atom)
for (i = 1; i <= count; ++i) {
uint32_t key_size = avio_rb32(pb);
uint32_t type = avio_rl32(pb);
- if (key_size < 8) {
+ if (key_size < 8 || key_size > atom.size) {
av_log(c->fc, AV_LOG_ERROR,
"The key# %"PRIu32" in meta has invalid size:"
"%"PRIu32"\n", i, key_size);
return AVERROR_INVALIDDATA;
}
+ atom.size -= key_size;
key_size -= 8;
if (type != MKTAG('m','d','t','a')) {
avio_skip(pb, key_size);
Applied. Thanks.
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
