Commit bb95334c authored by Michael Niedermayer's avatar Michael Niedermayer Committed by Martin Storsjö
Browse files

qt-faststart: Check offset_count before reading from the moov_atom buffer



CC: libav-stable@libav.org
Signed-off-by: default avatarMartin Storsjö <martin@martin.st>
parent 63848854
...@@ -239,6 +239,10 @@ int main(int argc, char *argv[]) ...@@ -239,6 +239,10 @@ int main(int argc, char *argv[])
goto error_out; goto error_out;
} }
offset_count = BE_32(&moov_atom[i + 8]); offset_count = BE_32(&moov_atom[i + 8]);
if (i + 12 + offset_count * UINT64_C(4) > moov_atom_size) {
printf(" bad atom size/element count\n");
goto error_out;
}
for (j = 0; j < offset_count; j++) { for (j = 0; j < offset_count; j++) {
current_offset = BE_32(&moov_atom[i + 12 + j * 4]); current_offset = BE_32(&moov_atom[i + 12 + j * 4]);
current_offset += moov_atom_size; current_offset += moov_atom_size;
...@@ -256,6 +260,10 @@ int main(int argc, char *argv[]) ...@@ -256,6 +260,10 @@ int main(int argc, char *argv[])
goto error_out; goto error_out;
} }
offset_count = BE_32(&moov_atom[i + 8]); offset_count = BE_32(&moov_atom[i + 8]);
if (i + 12 + offset_count * UINT64_C(8) > moov_atom_size) {
printf(" bad atom size/element count\n");
goto error_out;
}
for (j = 0; j < offset_count; j++) { for (j = 0; j < offset_count; j++) {
current_offset = BE_64(&moov_atom[i + 12 + j * 8]); current_offset = BE_64(&moov_atom[i + 12 + j * 8]);
current_offset += moov_atom_size; current_offset += moov_atom_size;
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment