From patchwork Sun Oct 23 16:28:37 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andreas Cadhalpun X-Patchwork-Id: 1144 Delivered-To: ffmpegpatchwork@gmail.com Received: by 10.103.140.133 with SMTP id o127csp1837616vsd; Sun, 23 Oct 2016 09:28:46 -0700 (PDT) X-Received: by 10.28.0.2 with SMTP id 2mr11828415wma.79.1477240126817; Sun, 23 Oct 2016 09:28:46 -0700 (PDT) Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id b205si8051787wmb.95.2016.10.23.09.28.46; Sun, 23 Oct 2016 09:28:46 -0700 (PDT) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@googlemail.com; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=QUARANTINE dis=NONE) header.from=googlemail.com Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 9DDE5689CC5; Sun, 23 Oct 2016 19:28:41 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from mail-wm0-f65.google.com (mail-wm0-f65.google.com [74.125.82.65]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 9DB66689CB2 for ; Sun, 23 Oct 2016 19:28:35 +0300 (EEST) Received: by mail-wm0-f65.google.com with SMTP id d128so6299471wmf.0 for ; Sun, 23 Oct 2016 09:28:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20120113; h=from:subject:to:references:message-id:date:user-agent:mime-version :in-reply-to:content-transfer-encoding; bh=/vrfZtIp+YUhTfBydmqCWs/WWhvyYe2zBzJ9eob54Rc=; b=b2CLPUvbj4fvbUlwCIePxW3l0uhJ6JpJDvdB6oSyOwNAg7YckY5Qr1+W1xKXoCVVpu hX1iiLJmPZah/s1l2icvWphs2OLII9PYjxgHTlxrkw0j0BI2DbJZYkQHqGAYE12OD1Ki CsBXfJAlhC1aL39UU9VOGdb9yC0feq1YeiIiH04Kf/LCl0SWSrcP1zeYSWcr11+qc9Gz 8NihC3DZjVmIJQCvGDNWcsNb7RIGbraBKH4gGXfMAW7StxSAr2joNaUN/UBG2W868DJO Xj37OyiQ8Kf6unKrPm0esFuehbZYgGKuqbgH3vfGky4XYKpmiJg3I3kaSLWixQAPCnck Cjdw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:subject:to:references:message-id:date :user-agent:mime-version:in-reply-to:content-transfer-encoding; bh=/vrfZtIp+YUhTfBydmqCWs/WWhvyYe2zBzJ9eob54Rc=; b=J0hybmgjM1Er187ciPTWAPjZEoPDX8sFgfmqVXeWcIB8Mou9Yqx6yeC74QWRgWjt7Q 7dssEyihZzMHglhcwXSj90vmp+UlhDgXs0t/nrPI92tz25m74HJsTDOCgtW2zRxovfYn lmjfinteTE9s/1ezo4sh78jFITU4ESbt63b59SZmZtdO7D9Ji4g0v62yM/FfJLUFU7jp YNxkSEcgZi4gSlXn925JmMY18GzkBED/JrvjDdDOHbbp3dzkIZYpxXx3wfZIwW0ASeKV 6+CMNN8U2OI1dEzEvNxg18rvejMbvgpW6uHGAfI4eeG8Z28v3TIMTEaBG8PNGJvbr49r 1K6w== X-Gm-Message-State: ABUngvfKcRPG5UQmuiitrR4Kb5s1DDt6aSX3tqwVbiQIfW01Jhh6G3kjpKPObaC2EjxNgw== X-Received: by 10.28.54.209 with SMTP id y78mr10836551wmh.94.1477240118328; Sun, 23 Oct 2016 09:28:38 -0700 (PDT) Received: from [192.168.2.21] (p5B095E5A.dip0.t-ipconnect.de. [91.9.94.90]) by smtp.googlemail.com with ESMTPSA id bl3sm14558328wjc.26.2016.10.23.09.28.37 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 23 Oct 2016 09:28:37 -0700 (PDT) From: Andreas Cadhalpun X-Google-Original-From: Andreas Cadhalpun To: FFmpeg development discussions and patches References: <6622a3c7-3900-8982-1179-4ccdd0fec2b3@googlemail.com> Message-ID: Date: Sun, 23 Oct 2016 18:28:37 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Icedove/45.4.0 MIME-Version: 1.0 In-Reply-To: <6622a3c7-3900-8982-1179-4ccdd0fec2b3@googlemail.com> Subject: [FFmpeg-devel] [PATCH 05/12] mov: validate time_scale X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" A negative timescale doesn't make sense and triggers assertions in av_rescale_rnd. Signed-off-by: Andreas Cadhalpun --- libavformat/mov.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 0a3fdd1..6f313a5 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -1223,6 +1223,10 @@ static int mov_read_mdhd(MOVContext *c, AVIOContext *pb, MOVAtom atom) mov_metadata_creation_time(&st->metadata, creation_time); sc->time_scale = avio_rb32(pb); + if (sc->time_scale <= 0) { + av_log(c->fc, AV_LOG_ERROR, "Invalid mdhd time scale %d\n", sc->time_scale); + return AVERROR_INVALIDDATA; + } st->duration = (version == 1) ? avio_rb64(pb) : avio_rb32(pb); /* duration */ lang = avio_rb16(pb); /* language */ @@ -1248,7 +1252,10 @@ static int mov_read_mvhd(MOVContext *c, AVIOContext *pb, MOVAtom atom) } mov_metadata_creation_time(&c->fc->metadata, creation_time); c->time_scale = avio_rb32(pb); /* time scale */ - + if (c->time_scale <= 0) { + av_log(c->fc, AV_LOG_ERROR, "Invalid mvhd time scale %d\n", c->time_scale); + return AVERROR_INVALIDDATA; + } av_log(c->fc, AV_LOG_TRACE, "time scale = %i\n", c->time_scale); c->duration = (version == 1) ? avio_rb64(pb) : avio_rb32(pb); /* duration */