har0ke/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avformat/mov: Fix DoS in read_tfra()

Browse Source 
Fixes: Missing EOF check in loop
No testcase

Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9cb4eb772839c5e1de2855d126bf74ff16d13382)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2017-09-05 00:16:29 +02:00
parent 372bb59438
commit c9527df274
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
libavformat/mov.c
View File

@ -5394,6 +5394,13 @@ static int read_tfra(MOVContext *mov, AVIOContext *f)
} }
for (i = 0; i < index->item_count; i++) { for (i = 0; i < index->item_count; i++) {
int64_t time, offset; int64_t time, offset;
if (avio_feof(f)) {
index->item_count = 0;
av_freep(&index->items);
return AVERROR_INVALIDDATA;
}
if (version == 1) { if (version == 1) {
time = avio_rb64(f); time = avio_rb64(f);
offset = avio_rb64(f); offset = avio_rb64(f);