| Message ID | 20240520014157.5399-1-jamrial@gmail.com |
|---|---|
| State | Accepted |
| Commit | 3146b77a7d314f55b8ec5d8ce6fda2c5db049a27 |
| Headers | show |
| Series | [FFmpeg-devel] avformat/mov: store sample_sizes as unsigned ints | expand |
| Context | Check | Description |
|---|---|---|
| yinshiyou/make_loongarch64 | success | Make finished |
| yinshiyou/make_fate_loongarch64 | success | Make fate finished |
On 5/19/2024 10:41 PM, James Almer wrote: > As defined in Section 8.7.3.2.1 of ISO 14496-12. > Any unsupported value will be rejected in mov_build_index() without outright > aborting demuxing. > > Fixes ticket #11005. > > Signed-off-by: James Almer <jamrial@gmail.com> > --- > libavformat/isom.h | 2 +- > libavformat/mov.c | 4 ++-- > 2 files changed, 3 insertions(+), 3 deletions(-) > > diff --git a/libavformat/isom.h b/libavformat/isom.h > index 07f09d6eff..c0a5788e08 100644 > --- a/libavformat/isom.h > +++ b/libavformat/isom.h > @@ -193,7 +193,7 @@ typedef struct MOVStreamContext { > unsigned int sample_size; ///< may contain value calculated from stsd or value from stsz atom > unsigned int stsz_sample_size; ///< always contains sample size from stsz atom > unsigned int sample_count; > - int *sample_sizes; > + unsigned int *sample_sizes; > int keyframe_absent; > unsigned int keyframe_count; > int *keyframes; > diff --git a/libavformat/mov.c b/libavformat/mov.c > index b3fa748f27..54c2d1eebc 100644 > --- a/libavformat/mov.c > +++ b/libavformat/mov.c > @@ -3308,9 +3308,9 @@ static int mov_read_stsz(MOVContext *c, AVIOContext *pb, MOVAtom atom) > > for (i = 0; i < entries; i++) { > sc->sample_sizes[i] = get_bits_long(&gb, field_size); > - if (sc->sample_sizes[i] < 0) { > + if (sc->sample_sizes[i] > INT64_MAX - sc->data_size) { > av_free(buf); > - av_log(c->fc, AV_LOG_ERROR, "Invalid sample size %d\n", sc->sample_sizes[i]); > + av_log(c->fc, AV_LOG_ERROR, "Sample size overflow in STSZ\n"); > return AVERROR_INVALIDDATA; > } > sc->data_size += sc->sample_sizes[i]; Will apply.
diff --git a/libavformat/isom.h b/libavformat/isom.h index 07f09d6eff..c0a5788e08 100644 --- a/libavformat/isom.h +++ b/libavformat/isom.h @@ -193,7 +193,7 @@ typedef struct MOVStreamContext { unsigned int sample_size; ///< may contain value calculated from stsd or value from stsz atom unsigned int stsz_sample_size; ///< always contains sample size from stsz atom unsigned int sample_count; - int *sample_sizes; + unsigned int *sample_sizes; int keyframe_absent; unsigned int keyframe_count; int *keyframes; diff --git a/libavformat/mov.c b/libavformat/mov.c index b3fa748f27..54c2d1eebc 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -3308,9 +3308,9 @@ static int mov_read_stsz(MOVContext *c, AVIOContext *pb, MOVAtom atom) for (i = 0; i < entries; i++) { sc->sample_sizes[i] = get_bits_long(&gb, field_size); - if (sc->sample_sizes[i] < 0) { + if (sc->sample_sizes[i] > INT64_MAX - sc->data_size) { av_free(buf); - av_log(c->fc, AV_LOG_ERROR, "Invalid sample size %d\n", sc->sample_sizes[i]); + av_log(c->fc, AV_LOG_ERROR, "Sample size overflow in STSZ\n"); return AVERROR_INVALIDDATA; } sc->data_size += sc->sample_sizes[i];
As defined in Section 8.7.3.2.1 of ISO 14496-12. Any unsupported value will be rejected in mov_build_index() without outright aborting demuxing. Fixes ticket #11005. Signed-off-by: James Almer <jamrial@gmail.com> --- libavformat/isom.h | 2 +- libavformat/mov.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-)