libavformat.hg: mov.c comparison

comparison mov.c @ 639:0b52743104ac libavformat

integer overflows, heap corruption possible arbitrary code execution cannot be ruled out in some cases precautionary checks

author	michael
date	Sat, 08 Jan 2005 14:21:33 +0000
parents	adc5295cd0a2
children	6f3a6774df82

comparison

equal deleted inserted replaced

-:5188094c6ec4
+:0b52743104ac
 	for (i = 0; c->parse_table[i].type != 0L
 	     && c->parse_table[i].type != a.type; i++)
 	    /* empty */;
 	a.size -= 8;
+if(a.size < 0)
+break;
 //        av_log(NULL, AV_LOG_DEBUG, " i=%ld\n", i);
 	if (c->parse_table[i].type == 0) { /* skip leaf atoms data */
 //            url_seek(pb, atom.offset+atom.size, SEEK_SET);
 #ifdef DEBUG
 print_atom("unknown", a);
 static int mov_read_ctab(MOVContext *c, ByteIOContext *pb, MOV_atom_t atom)
 {
 unsigned int len;
 MOV_ctab_t *t;
-//url_fskip(pb, atom.size); // for now
+#if 1
+url_fskip(pb, atom.size); // for now
+#else
+VERY VERY BROKEN, NEVER execute this, needs rewrite
 c->ctab = av_realloc(c->ctab, ++c->ctab_size);
 t = c->ctab[c->ctab_size];
 t->seed = get_be32(pb);
 t->flags = get_be16(pb);
 t->size = get_be16(pb) + 1;
 if (len > 0) {
 	t->clrs = av_malloc(len); // 16bit A R G B
 	if (t->clrs)
 	    get_buffer(pb, t->clrs, len);
 }
+#endif
 return 0;
 }
 static int mov_read_hdlr(MOVContext *c, ByteIOContext *pb, MOV_atom_t atom)
 static int mov_read_smi(MOVContext *c, ByteIOContext *pb, MOV_atom_t atom)
 {
 AVStream *st = c->fc->streams[c->fc->nb_streams-1];
+if((uint64_t)atom.size > (1<<30))
+return -1;
 // currently SVQ3 decoder expect full STSD header - so let's fake it
 // this should be fixed and just SMI header should be passed
 av_free(st->codec.extradata);
 st->codec.extradata_size = 0x5a + atom.size;
 st->codec.extradata = (uint8_t*) av_mallocz(st->codec.extradata_size + FF_INPUT_BUFFER_PADDING_SIZE);
 static int mov_read_avcC(MOVContext *c, ByteIOContext *pb, MOV_atom_t atom)
 {
 AVStream *st = c->fc->streams[c->fc->nb_streams-1];
+if((uint64_t)atom.size > (1<<30))
+return -1;
 av_free(st->codec.extradata);
 st->codec.extradata_size = atom.size;
 st->codec.extradata = (uint8_t*) av_mallocz(st->codec.extradata_size + FF_INPUT_BUFFER_PADDING_SIZE);
 static int mov_read_stco(MOVContext *c, ByteIOContext *pb, MOV_atom_t atom)
 {
 AVStream *st = c->fc->streams[c->fc->nb_streams-1];
 MOVStreamContext *sc = (MOVStreamContext *)st->priv_data;
-int entries, i;
+unsigned int i, entries;
 print_atom("stco", atom);
 get_byte(pb); /* version */
 get_byte(pb); get_byte(pb); get_byte(pb); /* flags */
 entries = get_be32(pb);
+if(entries >= UINT_MAX/sizeof(int64_t))
+return -1;
 sc->chunk_count = entries;
 sc->chunk_offsets = (int64_t*) av_malloc(entries * sizeof(int64_t));
 if (!sc->chunk_offsets)
 return -1;
 if (atom.type == MKTAG('s', 't', 'c', 'o')) {
 static int mov_read_stsc(MOVContext *c, ByteIOContext *pb, MOV_atom_t atom)
 {
 AVStream *st = c->fc->streams[c->fc->nb_streams-1];
 MOVStreamContext *sc = (MOVStreamContext *)st->priv_data;
-int entries, i;
+unsigned int i, entries;
 print_atom("stsc", atom);
 get_byte(pb); /* version */
 get_byte(pb); get_byte(pb); get_byte(pb); /* flags */
 entries = get_be32(pb);
+if(entries >= UINT_MAX / sizeof(MOV_sample_to_chunk_tbl))
+return -1;
 #ifdef DEBUG
 av_log(NULL, AV_LOG_DEBUG, "track[%i].stsc.entries = %i\n", c->fc->nb_streams-1, entries);
 #endif
 sc->sample_to_chunk_sz = entries;
 sc->sample_to_chunk = (MOV_sample_to_chunk_tbl*) av_malloc(entries * sizeof(MOV_sample_to_chunk_tbl));
 static int mov_read_stss(MOVContext *c, ByteIOContext *pb, MOV_atom_t atom)
 {
 AVStream *st = c->fc->streams[c->fc->nb_streams-1];
 MOVStreamContext *sc = (MOVStreamContext *)st->priv_data;
-int entries, i;
+unsigned int i, entries;
 print_atom("stss", atom);
 get_byte(pb); /* version */
 get_byte(pb); get_byte(pb); get_byte(pb); /* flags */
 entries = get_be32(pb);
+if(entries >= UINT_MAX / sizeof(long))
+return -1;
 sc->keyframe_count = entries;
 #ifdef DEBUG
 av_log(NULL, AV_LOG_DEBUG, "keyframe_count = %ld\n", sc->keyframe_count);
 #endif
 sc->keyframes = (long*) av_malloc(entries * sizeof(long));
 static int mov_read_stsz(MOVContext *c, ByteIOContext *pb, MOV_atom_t atom)
 {
 AVStream *st = c->fc->streams[c->fc->nb_streams-1];
 MOVStreamContext *sc = (MOVStreamContext *)st->priv_data;
-int entries, i;
+unsigned int i, entries;
 print_atom("stsz", atom);
 get_byte(pb); /* version */
 get_byte(pb); get_byte(pb); get_byte(pb); /* flags */
 sc->sample_size = get_be32(pb);
 entries = get_be32(pb);
+if(entries >= UINT_MAX / sizeof(long))
+return -1;
 sc->sample_count = entries;
 #ifdef DEBUG
 av_log(NULL, AV_LOG_DEBUG, "sample_size = %ld sample_count = %ld\n", sc->sample_size, sc->sample_count);
 #endif
 if(sc->sample_size)
 static int mov_read_stts(MOVContext *c, ByteIOContext *pb, MOV_atom_t atom)
 {
 AVStream *st = c->fc->streams[c->fc->nb_streams-1];
 //MOVStreamContext *sc = (MOVStreamContext *)st->priv_data;
-int entries, i;
+unsigned int i, entries;
 int64_t duration=0;
 int64_t total_sample_count=0;
 print_atom("stts", atom);
 get_byte(pb); /* version */
 get_byte(pb); get_byte(pb); get_byte(pb); /* flags */
 entries = get_be32(pb);
+if(entries >= UINT_MAX / sizeof(uint64_t))
+return -1;
 c->streams[c->fc->nb_streams-1]->stts_count = entries;
 c->streams[c->fc->nb_streams-1]->stts_data = (uint64_t*) av_malloc(entries * sizeof(uint64_t));
 #ifdef DEBUG

Mercurial > libavformat.hg

comparison mov.c @ 639:0b52743104ac libavformat