Browse Source

lavf/mov.c: Avoid heap allocation wrap in mov_read_uuid

Core of patch is from paul@paulmehta.com
Reference https://crbug.com/643951

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Check value reduced as the code does not support values beyond INT_MAX
Also the check is moved to a more common place and before integer truncation

(cherry picked from commit 2d453188c2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
tags/n3.0.7
Matt Wolenetz Michael Niedermayer 9 years ago
parent
commit
dc1e099bf2
1 changed files with 1 additions and 1 deletions
  1. +1
    -1
      libavformat/mov.c

+ 1
- 1
libavformat/mov.c View File

@@ -3901,7 +3901,7 @@ static int mov_read_uuid(MOVContext *c, AVIOContext *pb, MOVAtom atom)
0x9c, 0x71, 0x99, 0x94, 0x91, 0xe3, 0xaf, 0xac
};

if (atom.size < sizeof(uuid) || atom.size == INT64_MAX)
if (atom.size < sizeof(uuid) || atom.size >= FFMIN(INT_MAX, SIZE_MAX))
return AVERROR_INVALIDDATA;

ret = avio_read(pb, uuid, sizeof(uuid));


Loading…
Cancel
Save