[FFmpeg-cvslog] avformat/mov: Check samplesize and offset to avoid integer overflow
Michael Niedermayer
git at videolan.org
Thu Oct 19 14:30:42 EEST 2023
ffmpeg | branch: release/2.8 | Michael Niedermayer <michael at niedermayer.cc> | Mon Feb 20 19:19:32 2023 +0100| [3a2f0caf9f1d97d5e73a3ee20f4a964484d1fa25] | committer: Michael Niedermayer
avformat/mov: Check samplesize and offset to avoid integer overflow
Fixes: signed integer overflow: 9223372036854775584 + 536870912 cannot be represented in type 'long'
Fixes: 55844/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-510613920664780
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
(cherry picked from commit 53c1f5c2e28e54ea8174b196d5cf4a158907395a)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3a2f0caf9f1d97d5e73a3ee20f4a964484d1fa25
---
libavformat/mov.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index e225dde84b..9aa2f019d3 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -2750,6 +2750,13 @@ static void mov_build_index(MOVContext *mov, AVStream *st)
if (keyframe)
distance = 0;
sample_size = sc->stsz_sample_size > 0 ? sc->stsz_sample_size : sc->sample_sizes[current_sample];
+ if (current_offset > INT64_MAX - sample_size) {
+ av_log(mov->fc, AV_LOG_ERROR, "Current offset %"PRId64" or sample size %u is too large\n",
+ current_offset,
+ sample_size);
+ return;
+ }
+
if (sc->pseudo_stream_id == -1 ||
sc->stsc_data[stsc_index].id - 1 == sc->pseudo_stream_id) {
AVIndexEntry *e;
More information about the ffmpeg-cvslog
mailing list