[FFmpeg-devel] [PATCH] lavf/mov.c: Avoid heap allocation wrap in mov_read_hdlr

[Matthew Wolenetz]

Updated to SIZE_MAX. Thank you for your comments.


On Thu, Dec 15, 2016 at 5:23 PM, Andreas Cadhalpun <
andreas.cadhalpun at googlemail.com> wrote:

> On 15.12.2016 03:25, James Almer wrote:
> > On 12/14/2016 10:39 PM, Andreas Cadhalpun wrote:
> >> On 15.12.2016 00:34, Matthew Wolenetz wrote:
> >>>
> >>> From fd878457cd55690d4a27d74411b68a30c9fb2313 Mon Sep 17 00:00:00 2001
> >>> From: Matt Wolenetz <wolenetz at chromium.org>
> >>> Date: Fri, 2 Dec 2016 18:10:39 -0800
> >>> Subject: [PATCH] lavf/mov.c: Avoid heap allocation wrap in
> mov_read_hdlr
> >>>
> >>> Core of patch is from paul at paulmehta.com
> >>> Reference https://crbug.com/643950
> >>> ---
> >>>  libavformat/mov.c | 2 ++
> >>>  1 file changed, 2 insertions(+)
> >>>
> >>> diff --git a/libavformat/mov.c b/libavformat/mov.c
> >>> index 2a69890..7254505 100644
> >>> --- a/libavformat/mov.c
> >>> +++ b/libavformat/mov.c
> >>> @@ -739,6 +739,8 @@ static int mov_read_hdlr(MOVContext *c,
> AVIOContext *pb, MOVAtom atom)
> >>>
> >>>      title_size = atom.size - 24;
> >>>      if (title_size > 0) {
> >>> +        if (title_size >= UINT_MAX)
> >>
> >> I think this should use SIZE_MAX.
> >
> > title_size is int64_t and SIZE_MAX is UINT64_MAX on x86_64.
>
> Yes, but the argument of av_malloc is size_t.
>
> >>
> >>> +            return AVERROR_INVALIDDATA;
> >>>          title_str = av_malloc(title_size + 1); /* Add null terminator
> */
>
> So this should cast the argument to size_t to fix the issue on x86_64:
>           title_str = av_malloc((size_t)title_size + 1); /* Add null
> terminator */
>
> Best regards,
> Andreas
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel at ffmpeg.org
> http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 643950-lavf-mov.c-Avoid-heap-allocation-wrap-in-mov_read_hd.patch
Type: text/x-patch
Size: 954 bytes
Desc: not available
URL: <http://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20170207/60f83699/attachment.bin>