[FFmpeg-devel] [PATCH] avformat/mov: store sample_sizes as unsigned ints

[FFmpeg-devel] [PATCH] avformat/mov: store sample_sizes as unsigned ints

[James Almer]

As defined in Section 8.7.3.2.1 of ISO 14496-12.
Any unsupported value will be rejected in mov_build_index() without outright
aborting demuxing.

Fixes ticket #11005.

Signed-off-by: James Almer <jamrial@gmail.com>
---
 libavformat/isom.h | 2 +-
 libavformat/mov.c  | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/libavformat/isom.h b/libavformat/isom.h
index 07f09d6eff..c0a5788e08 100644
--- a/libavformat/isom.h
+++ b/libavformat/isom.h
@@ -193,7 +193,7 @@ typedef struct MOVStreamContext {
     unsigned int sample_size; ///< may contain value calculated from stsd or value from stsz atom
     unsigned int stsz_sample_size; ///< always contains sample size from stsz atom
     unsigned int sample_count;
-    int *sample_sizes;
+    unsigned int *sample_sizes;
     int keyframe_absent;
     unsigned int keyframe_count;
     int *keyframes;
diff --git a/libavformat/mov.c b/libavformat/mov.c
index b3fa748f27..54c2d1eebc 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -3308,9 +3308,9 @@ static int mov_read_stsz(MOVContext *c, AVIOContext *pb, MOVAtom atom)
 
     for (i = 0; i < entries; i++) {
         sc->sample_sizes[i] = get_bits_long(&gb, field_size);
-        if (sc->sample_sizes[i] < 0) {
+        if (sc->sample_sizes[i] > INT64_MAX - sc->data_size) {
             av_free(buf);
-            av_log(c->fc, AV_LOG_ERROR, "Invalid sample size %d\n", sc->sample_sizes[i]);
+            av_log(c->fc, AV_LOG_ERROR, "Sample size overflow in STSZ\n");
             return AVERROR_INVALIDDATA;
         }
         sc->data_size += sc->sample_sizes[i];
-- 
2.45.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH] avformat/mov: store sample_sizes as unsigned ints

[James Almer]

On 5/19/2024 10:41 PM, James Almer wrote:
> As defined in Section 8.7.3.2.1 of ISO 14496-12.
> Any unsupported value will be rejected in mov_build_index() without outright
> aborting demuxing.
> 
> Fixes ticket #11005.
> 
> Signed-off-by: James Almer <jamrial@gmail.com>
> ---
>   libavformat/isom.h | 2 +-
>   libavformat/mov.c  | 4 ++--
>   2 files changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/libavformat/isom.h b/libavformat/isom.h
> index 07f09d6eff..c0a5788e08 100644
> --- a/libavformat/isom.h
> +++ b/libavformat/isom.h
> @@ -193,7 +193,7 @@ typedef struct MOVStreamContext {
>       unsigned int sample_size; ///< may contain value calculated from stsd or value from stsz atom
>       unsigned int stsz_sample_size; ///< always contains sample size from stsz atom
>       unsigned int sample_count;
> -    int *sample_sizes;
> +    unsigned int *sample_sizes;
>       int keyframe_absent;
>       unsigned int keyframe_count;
>       int *keyframes;
> diff --git a/libavformat/mov.c b/libavformat/mov.c
> index b3fa748f27..54c2d1eebc 100644
> --- a/libavformat/mov.c
> +++ b/libavformat/mov.c
> @@ -3308,9 +3308,9 @@ static int mov_read_stsz(MOVContext *c, AVIOContext *pb, MOVAtom atom)
>   
>       for (i = 0; i < entries; i++) {
>           sc->sample_sizes[i] = get_bits_long(&gb, field_size);
> -        if (sc->sample_sizes[i] < 0) {
> +        if (sc->sample_sizes[i] > INT64_MAX - sc->data_size) {
>               av_free(buf);
> -            av_log(c->fc, AV_LOG_ERROR, "Invalid sample size %d\n", sc->sample_sizes[i]);
> +            av_log(c->fc, AV_LOG_ERROR, "Sample size overflow in STSZ\n");
>               return AVERROR_INVALIDDATA;
>           }
>           sc->data_size += sc->sample_sizes[i];

Will apply.
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".