har0ke/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avformat/mxfdec: do not allow more partitions than INT_MAX/2

Browse Source 
Some math (e.g: partition binary search) overflows if we have that many
parititions.

Signed-off-by: Marton Balint <cus@passwd.hu>
This commit is contained in:
Marton Balint 2018-03-09 00:46:06 +01:00
parent 90756e67a0
commit cf5ffe0183
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
libavformat/mxfdec.c
View File

@ -565,6 +565,9 @@ static int mxf_read_partition_pack(void *arg, AVIOContext *pb, int tag, int size
uint64_t footer_partition; uint64_t footer_partition;
uint32_t nb_essence_containers; uint32_t nb_essence_containers;
if (mxf->partitions_count >= INT_MAX / 2)
return AVERROR_INVALIDDATA;
tmp_part = av_realloc_array(mxf->partitions, mxf->partitions_count + 1, sizeof(*mxf->partitions)); tmp_part = av_realloc_array(mxf->partitions, mxf->partitions_count + 1, sizeof(*mxf->partitions));
if (!tmp_part) if (!tmp_part)
return AVERROR(ENOMEM); return AVERROR(ENOMEM);