[FFmpeg-devel] [PATCH v3 2/2] avformat/mov: validate box size for stts

From: Gyan Doshi <ffmpeg@gyani.pro>
To: ffmpeg-devel@ffmpeg.org
Subject: [FFmpeg-devel] [PATCH v3 2/2] avformat/mov: validate box size for stts
Date: Thu, 23 Dec 2021 12:49:13 +0530
Message-ID: <20211223071913.50635-2-ffmpeg@gyani.pro> (raw)
In-Reply-To: <20211223071913.50635-1-ffmpeg@gyani.pro>

---
 libavformat/mov.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index e223e95e2e..71404ba07a 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -2968,6 +2968,12 @@ static int mov_read_stts(MOVContext *c, AVIOContext *pb, MOVAtom atom)
     avio_rb24(pb); /* flags */
     entries = avio_rb32(pb);
 
+    if (validate_box_size(c, atom, pb, avio_tell(pb)-8, 8+(int64_t)entries*8, 1)) {
+        av_log(c->fc, AV_LOG_ERROR, "Invalid or incomplete %s box in stream %d\n",
+               av_fourcc2str(atom.type), c->fc->nb_streams-1);
+       return AVERROR_INVALIDDATA;
+    }
+
     av_log(c->fc, AV_LOG_TRACE, "track[%u].stts.entries = %u\n",
             c->fc->nb_streams-1, entries);
 
-- 
2.33.0

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
