git.videolan.org
/
ffmpeg.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(from parent 1:
26a19f8
)
avformat/mov: Fix potential integer overflow in mov_read_keys
author
Sergey Volk
<servolk@google.com>
Wed, 7 Sep 2016 21:05:35 +0000
(14:05 -0700)
committer
Michael Niedermayer
<michael@niedermayer.cc>
Thu, 8 Sep 2016 09:35:44 +0000
(11:35 +0200)
Actual allocation size is computed as (count + 1)*sizeof(meta_keys), so
we need to check that (count + 1) won't cause overflow.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavformat/mov.c
patch
|
blob
|
history
diff --git
a/libavformat/mov.c
b/libavformat/mov.c
index
f499906
..
a7595c5
100644
(file)
--- a/
libavformat/mov.c
+++ b/
libavformat/mov.c
@@
-3278,7
+3278,7
@@
static int mov_read_keys(MOVContext *c, AVIOContext *pb, MOVAtom atom)
avio_skip(pb, 4);
count = avio_rb32(pb);
- if (count > UINT_MAX / sizeof(*c->meta_keys)) {
+ if (count > UINT_MAX / sizeof(*c->meta_keys)
- 1
) {
av_log(c->fc, AV_LOG_ERROR,
"The 'keys' atom with the invalid key count: %d\n", count);
return AVERROR_INVALIDDATA;