[FFmpeg-devel] [PATCH] lavf/mov.c: Avoid heap allocation wrap in mov_read_hdlr

[Andreas Cadhalpun]

On 15.12.2016 03:25, James Almer wrote:
> On 12/14/2016 10:39 PM, Andreas Cadhalpun wrote:
>> On 15.12.2016 00:34, Matthew Wolenetz wrote:
>>>
>>> From fd878457cd55690d4a27d74411b68a30c9fb2313 Mon Sep 17 00:00:00 2001
>>> From: Matt Wolenetz <wolenetz at chromium.org>
>>> Date: Fri, 2 Dec 2016 18:10:39 -0800
>>> Subject: [PATCH] lavf/mov.c: Avoid heap allocation wrap in mov_read_hdlr
>>>
>>> Core of patch is from paul at paulmehta.com
>>> Reference https://crbug.com/643950
>>> ---
>>>  libavformat/mov.c | 2 ++
>>>  1 file changed, 2 insertions(+)
>>>
>>> diff --git a/libavformat/mov.c b/libavformat/mov.c
>>> index 2a69890..7254505 100644
>>> --- a/libavformat/mov.c
>>> +++ b/libavformat/mov.c
>>> @@ -739,6 +739,8 @@ static int mov_read_hdlr(MOVContext *c, AVIOContext *pb, MOVAtom atom)
>>>  
>>>      title_size = atom.size - 24;
>>>      if (title_size > 0) {
>>> +        if (title_size >= UINT_MAX)
>>
>> I think this should use SIZE_MAX.
> 
> title_size is int64_t and SIZE_MAX is UINT64_MAX on x86_64.

Yes, but the argument of av_malloc is size_t.

>>
>>> +            return AVERROR_INVALIDDATA;
>>>          title_str = av_malloc(title_size + 1); /* Add null terminator */

So this should cast the argument to size_t to fix the issue on x86_64:
          title_str = av_malloc((size_t)title_size + 1); /* Add null terminator */

Best regards,
Andreas