From patchwork Wed Sep 28 02:23:20 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sasi Inguva X-Patchwork-Id: 763 Delivered-To: ffmpegpatchwork@gmail.com Received: by 10.103.140.66 with SMTP id o63csp177207vsd; Tue, 27 Sep 2016 19:24:28 -0700 (PDT) X-Received: by 10.28.8.17 with SMTP id 17mr2589666wmi.81.1475029468285; Tue, 27 Sep 2016 19:24:28 -0700 (PDT) Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id l7si5969506wjf.272.2016.09.27.19.24.27; Tue, 27 Sep 2016 19:24:28 -0700 (PDT) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@google.com; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 48ABF689BA0; Wed, 28 Sep 2016 05:24:13 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from mail-pf0-f176.google.com (mail-pf0-f176.google.com [209.85.192.176]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 45C25689A53 for ; Wed, 28 Sep 2016 05:24:07 +0300 (EEST) Received: by mail-pf0-f176.google.com with SMTP id l25so11889125pfb.1 for ; Tue, 27 Sep 2016 19:24:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=from:to:cc:subject:date:message-id; bh=WxWGBH3XSMUAcqeESLLpqwx/Pqxm4eI1s0mvBho14u4=; b=X+7DEKS1ESzvNFZyKQNrChLElmpH1IOZri3JAoP/Oe9eRmTsFCS4Fy7qqm6MfaB2oS twfhKao6nstZwxDgQQismzsYCWFv5UN9N3qItIFrkmqeCq18gvpS1/Yu0EsMilFo1wjZ MNAtHy7u0GLsjLupuQjePBh4GNZ/cx6y0boVj98AU74GiK2Xydl7lE0yrUiSmLPWq4eO Duv9PgUQCG59pF/hVBTJLKHnpOUS61WyT4mWFOwTCas244e1rikPffZqpsXO7zY1ZruZ JLCMy7DLtMh5iMsEPFcCPVGc2wWoGCeIPSiopocXDmks1g00bUuquAIZrisfY9V3dgWN ODSQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=WxWGBH3XSMUAcqeESLLpqwx/Pqxm4eI1s0mvBho14u4=; b=cuBkiu0W0S5hyKoTBDRBgI5958Oha5LwADaTYHmjG10vh8pAffzpVXQNs202N+b6Kt dBBGfrMhOBxfzpZZ5ExHNDOFfsRx1H6pygqLk07ylI76FmX85jbMT+W7E21dpWzlGd0f hGG9qxvXYYrDNft52fXIESL7CQV/zgwR72n2OxNJ/Gf00/5AbTKfhpAJGTYksi3X006i pPYgB1aeqzmhNxlsLJD6s+v6TS7rT7+UixjJGcThKqZUbFQtJ96etQ8b7SwVWACOguOX HjNJXRQ2yZFVPVqidspkN1xfgkKnPukK7tddoXhgADRhQeTHjSyoGwBAQHaid8BvbF2i ZBMQ== X-Gm-Message-State: AE9vXwMH0ffKtJGUXCilay15Zbp+jy/D+a0Clz/BSzX/ui0phB+6Zbcm6/Umj6pn9P8LpOM0 X-Received: by 10.98.71.204 with SMTP id p73mr53917484pfi.20.1475029457098; Tue, 27 Sep 2016 19:24:17 -0700 (PDT) Received: from isasi.mtv.corp.google.com ([172.27.82.89]) by smtp.gmail.com with ESMTPSA id s74sm7731044pfs.44.2016.09.27.19.24.16 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Tue, 27 Sep 2016 19:24:16 -0700 (PDT) From: Sasi Inguva To: ffmpeg-devel@ffmpeg.org Date: Tue, 27 Sep 2016 19:23:20 -0700 Message-Id: <1475029400-19105-1-git-send-email-isasi@google.com> X-Mailer: git-send-email 2.8.0.rc3.226.g39d4020 Subject: [FFmpeg-devel] [PATCH] lavc/movtextdec.c: Avoid infinite loop on invalid data. X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Sasi Inguva MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Signed-off-by: Sasi Inguva --- libavcodec/movtextdec.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavcodec/movtextdec.c b/libavcodec/movtextdec.c index abf8711..a33fff7 100644 --- a/libavcodec/movtextdec.c +++ b/libavcodec/movtextdec.c @@ -471,6 +471,10 @@ static int mov_text_decode_frame(AVCodecContext *avctx, tsmb_type = AV_RB32(tsmb); tsmb += 4; + if (tsmb_size == 0) { + return AVERROR_INVALIDDATA; + } + if (tsmb_size == 1) { if (m->tracksize + 16 > avpkt->size) break;