Reported-by: Steve Lhomme
This was found through the Hacker One program on VLC but is not a security
issue in libavformat
Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc>
---
libavformat/matroskadec.c | 21 +++++++++++++++++++++
1 file changed, 21 insertions(+)
diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c
index 4ad99db7db..4b10f44712 100644
--- a/libavformat/matroskadec.c
+++ b/libavformat/matroskadec.c
@@ -792,6 +792,19 @@ static int matroska_resync(MatroskaDemuxContext *matroska,
int64_t last_pos)
return AVERROR_EOF;
}
+static int64_t ebml_parent_size_remaining(MatroskaDemuxContext *matroska)
+{
+ AVIOContext *pb = matroska->ctx->pb;
+ int64_t pos = avio_tell(pb);
+
+ if (matroska->num_levels > 0) {
+ MatroskaLevel *level = &matroska->levels[matroska->num_levels - 1];
+ if (level->length != (uint64_t)-1)
+ return level->length - (pos - level->start);
+ }
+ return INT64_MAX;
+}
+
/*
* Return: Whether we reached the end of a level in the hierarchy or not.
*/
@@ -1197,6 +1210,14 @@ static int ebml_parse_elem(MatroskaDemuxContext
*matroska,
length, max_lengths[syntax->type], syntax->type);
return AVERROR_INVALIDDATA;
}
+
+ av_assert0(length <= INT64_MAX);
+ if (ebml_parent_size_remaining(matroska) < (int64_t)length) {
+ av_log(matroska->ctx, AV_LOG_ERROR,
+ "Invalid length 0x%"PRIx64" > 0x%"PRIx64" parent length\n",
+ length, ebml_parent_size_remaining(matroska));
+ return AVERROR_INVALIDDATA;
+ }
}
switch (syntax->type) {
--
2.20.1
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
