[FFmpeg-cvslog] avformat/movenc: check that reel_name length doesn't exceed UINT16_MAX

[Mark Reid]

ffmpeg | branch: master | Mark Reid <mindmark at gmail.com> | Sun Aug 10 12:01:33 2014 -0700| [cab39afb1a9c8a86a00485fbba12a9ba26bea57d] | committer: Michael Niedermayer

avformat/movenc: check that reel_name length doesn't exceed UINT16_MAX

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=cab39afb1a9c8a86a00485fbba12a9ba26bea57d
---

 libavformat/movenc.c |   15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/libavformat/movenc.c b/libavformat/movenc.c
index 6a38e89..00dd7a3 100644
--- a/libavformat/movenc.c
+++ b/libavformat/movenc.c
@@ -1340,13 +1340,22 @@ static int mov_write_rtp_tag(AVIOContext *pb, MOVTrack *track)
     return update_size(pb, pos);
 }
 
-static int mov_write_source_reference_tag(AVIOContext *pb, MOVTrack *track, const char *reel_name){
+static int mov_write_source_reference_tag(AVIOContext *pb, MOVTrack *track, const char *reel_name)
+{
+    uint64_t str_size =strlen(reel_name);
     int64_t pos = avio_tell(pb);
+
+    if (str_size >= UINT16_MAX){
+        av_log(NULL, AV_LOG_ERROR, "reel_name length %llu is too large\n", str_size);
+        avio_wb16(pb, 0);
+        return AVERROR(EINVAL);
+    }
+
     avio_wb32(pb, 0);                              /* size */
     ffio_wfourcc(pb, "name");                      /* Data format */
-    avio_wb16(pb, strlen(reel_name));              /* string size */
+    avio_wb16(pb, str_size);                       /* string size */
     avio_wb16(pb, track->language);                /* langcode */
-    avio_write(pb, reel_name, strlen(reel_name));  /* reel name */
+    avio_write(pb, reel_name, str_size);           /* reel name */
     return update_size(pb,pos);
 }