wrapper/FFmpeg
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

avformat/mov: add more sanity checks when reading clap boxes

Browse source 
If the apperture window is bigger than the canvas, then the clap box is invalid
and there's no point calculating cropping values.

Fixes: libavformat/mov.c:1295:14: runtime error: -256 is outside the range of representable values of type 'unsigned long'

Signed-off-by: James Almer <jamrial@gmail.com>
This commit is contained in:
James Almer 2025-06-04 14:02:15 -03:00
parent dbe94e1110
commit f789d60e11
1 changed files with 5 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
libavformat/mov.c
View file

@ -1277,6 +1277,11 @@ static int mov_read_clap(MOVContext *c, AVIOContext *pb, MOVAtom atom)
err = AVERROR_INVALIDDATA;
goto fail;
}
if ((av_cmp_q((AVRational) { width, 1 }, aperture_width) < 0) ||
(av_cmp_q((AVRational) { height, 1 }, aperture_height) < 0)) {
err = AVERROR_INVALIDDATA;
goto fail;
}
av_log(c->fc, AV_LOG_TRACE, "clap: apertureWidth %d/%d, apertureHeight %d/%d "
"horizOff %d/%d vertOff %d/%d\n",
aperture_width.num, aperture_width.den, aperture_height.num, aperture_height.den,