Re: [FFmpeg-devel] [PATCH v2 2/2] avformat/mov: validate box size for stts

From: Michael Niedermayer <michael@niedermayer.cc>
To: FFmpeg development discussions and patches <ffmpeg-devel@ffmpeg.org>
Subject: Re: [FFmpeg-devel] [PATCH v2 2/2] avformat/mov: validate box size for stts
Date: Wed, 22 Dec 2021 22:34:17 +0100
Message-ID: <20211222213417.GE2829255@pb2> (raw)
In-Reply-To: <20211222124728.7300-2-ffmpeg@gyani.pro>

[-- Attachment #1.1: Type: text/plain, Size: 1195 bytes --]

On Wed, Dec 22, 2021 at 06:17:28PM +0530, Gyan Doshi wrote:
> ---
>  libavformat/mov.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/libavformat/mov.c b/libavformat/mov.c
> index 7de95b7ab0..1e44c74944 100644
> --- a/libavformat/mov.c
> +++ b/libavformat/mov.c
> @@ -2969,6 +2969,12 @@ static int mov_read_stts(MOVContext *c, AVIOContext *pb, MOVAtom atom)
>      avio_rb24(pb); /* flags */
>      entries = avio_rb32(pb);
>  
> +    if (validate_box_size(c, atom, pb, avio_tell(pb)-8, 8+(int64_t)entries*8, 0)) {
> +        av_log(c->fc, AV_LOG_ERROR, "Invalid or incomplete %s box in stream %d\n",
> +               av_fourcc2str(atom.type), c->fc->nb_streams-1);
> +       return AVERROR_INVALIDDATA;
> +    }
> +
>      av_log(c->fc, AV_LOG_TRACE, "track[%u].stts.entries = %u\n",
>              c->fc->nb_streams-1, entries);
>  

this breaks playback of

./ffplay H263_NM_f.mp4

i presume its this file here:
https://samples.ffmpeg.org/F4V/H263_NM_f.mp4

thx

[...]

-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Nations do behave wisely once they have exhausted all other alternatives. 
-- Abba Eban

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".