Commit 29b95052 authored by Michael Niedermayer's avatar Michael Niedermayer

avformat/mov: Fix DoS in read_tfra()

Fixes: Missing EOF check in loop
No testcase

Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9cb4eb77)
Signed-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
parent 5cc3add0
......@@ -4862,6 +4862,13 @@ static int read_tfra(MOVContext *mov, AVIOContext *f)
}
for (i = 0; i < index->item_count; i++) {
int64_t time, offset;
if (avio_feof(f)) {
index->item_count = 0;
av_freep(&index->items);
return AVERROR_INVALIDDATA;
}
if (version == 1) {
time = avio_rb64(f);
offset = avio_rb64(f);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment