diff mbox series

[FFmpeg-devel] avformat/mov: Check count sums in build_open_gop_key_points()

Message ID 20220823193737.12394-1-michael@niedermayer.cc
State Accepted
Commit c953baa084607dd1d84c3bfcce3cf6a87c3e6e05
Headers show
Series [FFmpeg-devel] avformat/mov: Check count sums in build_open_gop_key_points() | expand

Checks

Context Check Description
yinshiyou/make_loongarch64 success Make finished
yinshiyou/make_fate_loongarch64 success Make fate finished
andriy/make_x86 success Make finished
andriy/make_fate_x86 success Make fate finished

Commit Message

Michael Niedermayer Aug. 23, 2022, 7:37 p.m. UTC 
Fixes: ffmpeg.md
Fixes: Out of array access
Fixes: CVE-2022-2566

Found-by: Andy Nguyen <theflow@google.com>
Found-by: 3pvd <3pvd@google.com>
Reviewed-by: Andy Nguyen <theflow@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/mov.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

Comments

Michael Niedermayer Aug. 28, 2022, 5:52 p.m. UTC | #1 
On Tue, Aug 23, 2022 at 09:37:37PM +0200, Michael Niedermayer wrote:
> Fixes: ffmpeg.md
> Fixes: Out of array access
> Fixes: CVE-2022-2566
> 
> Found-by: Andy Nguyen <theflow@google.com>
> Found-by: 3pvd <3pvd@google.com>
> Reviewed-by: Andy Nguyen <theflow@google.com>
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavformat/mov.c | 12 ++++++++++--
>  1 file changed, 10 insertions(+), 2 deletions(-)

will apply

[...]
diff mbox series

Patch

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 1d8c5b2904..35e2271b14 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -3967,8 +3967,11 @@  static int build_open_gop_key_points(AVStream *st)
 
     /* Build an unrolled index of the samples */
     sc->sample_offsets_count = 0;
-    for (uint32_t i = 0; i < sc->ctts_count; i++)
+    for (uint32_t i = 0; i < sc->ctts_count; i++) {
+        if (sc->ctts_data[i].count > INT_MAX - sc->sample_offsets_count)
+            return AVERROR(ENOMEM);
         sc->sample_offsets_count += sc->ctts_data[i].count;
+    }
     av_freep(&sc->sample_offsets);
     sc->sample_offsets = av_calloc(sc->sample_offsets_count, sizeof(*sc->sample_offsets));
     if (!sc->sample_offsets)
@@ -3987,8 +3990,11 @@  static int build_open_gop_key_points(AVStream *st)
     /* Build a list of open-GOP key samples */
     sc->open_key_samples_count = 0;
     for (uint32_t i = 0; i < sc->sync_group_count; i++)
-        if (sc->sync_group[i].index == cra_index)
+        if (sc->sync_group[i].index == cra_index) {
+            if (sc->sync_group[i].count > INT_MAX - sc->open_key_samples_count)
+                return AVERROR(ENOMEM);
             sc->open_key_samples_count += sc->sync_group[i].count;
+        }
     av_freep(&sc->open_key_samples);
     sc->open_key_samples = av_calloc(sc->open_key_samples_count, sizeof(*sc->open_key_samples));
     if (!sc->open_key_samples)
@@ -3999,6 +4005,8 @@  static int build_open_gop_key_points(AVStream *st)
         if (sg->index == cra_index)
             for (uint32_t j = 0; j < sg->count; j++)
                 sc->open_key_samples[k++] = sample_id;
+        if (sg->count > INT_MAX - sample_id)
+            return AVERROR_PATCHWELCOME;
         sample_id += sg->count;
     }