wrapper/FFmpeg
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

qt-faststart: Check offset_count before reading from the moov_atom buffer

Browse source 
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit bb95334c34)
(cherry picked from commit 7754d48381)
This commit is contained in:
Michael Niedermayer 2012-12-13 15:07:20 +01:00 • committed by Reinhard Tartler
parent 460b948283
commit cb95c1935f
1 changed files with 8 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
tools/qt-faststart.c
View file

@ -225,6 +225,10 @@ int main(int argc, char *argv[])
goto error_out;
}
offset_count = BE_32(&moov_atom[i + 8]);
if (i + 12 + offset_count * UINT64_C(4) > moov_atom_size) {
printf(" bad atom size/element count\n");
goto error_out;
}
for (j = 0; j < offset_count; j++) {
current_offset = BE_32(&moov_atom[i + 12 + j * 4]);
current_offset += moov_atom_size;
@ -242,6 +246,10 @@ int main(int argc, char *argv[])
goto error_out;
}
offset_count = BE_32(&moov_atom[i + 8]);
if (i + 12 + offset_count * UINT64_C(8) > moov_atom_size) {
printf(" bad atom size/element count\n");
goto error_out;
}
for (j = 0; j < offset_count; j++) {
current_offset = BE_64(&moov_atom[i + 12 + j * 8]);
current_offset += moov_atom_size;