[FFmpeg-cvslog] avformat/mov: store sample_sizes as unsigned ints
James Almer
git at videolan.org
Wed May 22 23:49:24 EEST 2024
ffmpeg | branch: master | James Almer <jamrial at gmail.com> | Sun May 19 22:38:21 2024 -0300| [3146b77a7d314f55b8ec5d8ce6fda2c5db049a27] | committer: James Almer
avformat/mov: store sample_sizes as unsigned ints
As defined in Section 8.7.3.2.1 of ISO 14496-12.
Any unsupported value will be rejected in mov_build_index() without outright
aborting demuxing.
Fixes ticket #11005.
Signed-off-by: James Almer <jamrial at gmail.com>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3146b77a7d314f55b8ec5d8ce6fda2c5db049a27
---
libavformat/isom.h | 2 +-
libavformat/mov.c | 4 ++--
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/libavformat/isom.h b/libavformat/isom.h
index 07f09d6eff..c0a5788e08 100644
--- a/libavformat/isom.h
+++ b/libavformat/isom.h
@@ -193,7 +193,7 @@ typedef struct MOVStreamContext {
unsigned int sample_size; ///< may contain value calculated from stsd or value from stsz atom
unsigned int stsz_sample_size; ///< always contains sample size from stsz atom
unsigned int sample_count;
- int *sample_sizes;
+ unsigned int *sample_sizes;
int keyframe_absent;
unsigned int keyframe_count;
int *keyframes;
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 6174a04c31..45eca74d1d 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -3308,9 +3308,9 @@ static int mov_read_stsz(MOVContext *c, AVIOContext *pb, MOVAtom atom)
for (i = 0; i < entries; i++) {
sc->sample_sizes[i] = get_bits_long(&gb, field_size);
- if (sc->sample_sizes[i] < 0) {
+ if (sc->sample_sizes[i] > INT64_MAX - sc->data_size) {
av_free(buf);
- av_log(c->fc, AV_LOG_ERROR, "Invalid sample size %d\n", sc->sample_sizes[i]);
+ av_log(c->fc, AV_LOG_ERROR, "Sample size overflow in STSZ\n");
return AVERROR_INVALIDDATA;
}
sc->data_size += sc->sample_sizes[i];
More information about the ffmpeg-cvslog
mailing list