From: Gyan Doshi <ffmpeg@gyani.pro>
To: ffmpeg-devel@ffmpeg.org
Subject: [FFmpeg-devel] [PATCH] avformat/mov: abort reading truncated stts
Date: Tue, 21 Dec 2021 01:23:09 +0530
Message-ID: <20211220195310.5633-1-ffmpeg@gyani.pro> (raw)
Avoids overreading the box and ingesting absurd values into stts_data
---
Fixes prolonged demuxing for fuzzer-generated files in the loop added in
patch for max_stts_delta
libavformat/mov.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 2aed6e80ef..8d88119b29 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -2935,6 +2935,11 @@ static int mov_read_stts(MOVContext *c, AVIOContext *pb, MOVAtom atom)
avio_rb24(pb); /* flags */
entries = avio_rb32(pb);
+ if (atom.size < 8 + entries*8) {
+ av_log(c->fc, AV_LOG_ERROR, "Truncated STTS box for st %d.\n", c->fc->nb_streams-1);
+ return AVERROR_INVALIDDATA;
+ }
+
av_log(c->fc, AV_LOG_TRACE, "track[%u].stts.entries = %u\n",
c->fc->nb_streams-1, entries);
--
2.33.0
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
next reply other threads:[~2021-12-20 19:53 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-12-20 19:53 Gyan Doshi [this message]
2021-12-20 19:57 ` Andreas Rheinhardt
2021-12-20 20:36 ` Gyan Doshi
2021-12-20 20:38 ` Andreas Rheinhardt
2021-12-20 20:46 ` [FFmpeg-devel] [PATCH v2] " Gyan Doshi
2021-12-20 20:48 ` Andreas Rheinhardt
2021-12-20 20:50 ` Gyan Doshi
2021-12-20 20:54 ` Andreas Rheinhardt
2021-12-20 21:01 ` Gyan Doshi
2021-12-20 21:21 ` Michael Niedermayer
2021-12-20 21:36 ` Michael Niedermayer
2021-12-21 4:50 ` Gyan Doshi
2021-12-22 11:31 ` Gyan Doshi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211220195310.5633-1-ffmpeg@gyani.pro \
--to=ffmpeg@gyani.pro \
--cc=ffmpeg-devel@ffmpeg.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Git Inbox Mirror of the ffmpeg-devel mailing list - see https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
This inbox may be cloned and mirrored by anyone:
git clone --mirror https://master.gitmailbox.com/ffmpegdev/0 ffmpegdev/git/0.git
# If you have public-inbox 1.1+ installed, you may
# initialize and index your mirror using the following commands:
public-inbox-init -V2 ffmpegdev ffmpegdev/ https://master.gitmailbox.com/ffmpegdev \
ffmpegdev@gitmailbox.com
public-inbox-index ffmpegdev
Example config snippet for mirrors.
AGPL code for this site: git clone https://public-inbox.org/public-inbox.git