[FFmpeg-devel] [PATCH] avformat/mov: prevent excessive allocation in mov_read_udta_string

* [FFmpeg-devel] [PATCH] avformat/mov: prevent excessive allocation in mov_read_udta_string
@ 2025-07-30 11:32 Sanjay Jangid
  0 siblings, 0 replies; only message in thread
From: Sanjay Jangid @ 2025-07-30 11:32 UTC (permalink / raw)
  To: ffmpeg-devel

Signed-off-by: Sanjay Jangid <sanjayjangid20m@gmail.com>
---
libavformat/mov.c | 4 ++++
1 file changed, 4 insertions(+)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index c935bbf..725a9fa 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -459,6 +459,10 @@ retry:
            data_type = avio_rb32(pb); // type
            avio_rb32(pb); // unknown
            str_size = data_size - 16;
+            if (str_size >= INT_MAX / 2) {
+                 av_log(c->fc, AV_LOG_ERROR, "str_size is too large\n");
+                 return AVERROR_INVALIDDATA;
+             }
            atom.size -= 16;

            if (!key && c->found_hdlr_mdta && c->meta_keys) {
-- 
2.50.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

^ permalink raw reply	[flat|nested] only message in thread