[libav-stable] qt-faststart: Check offset_count before reading from the moov_atom buffer

Michael Niedermayer git at libav.org
Fri Feb 28 23:27:33 CET 2014


Module: libav
Branch: master
Commit: bb95334c34d0d9abccea370ae25c4765d7764ab8

Author:    Michael Niedermayer <michaelni at gmx.at>
Committer: Martin Storsjö <martin at martin.st>
Date:      Thu Dec 13 15:07:20 2012 +0100

qt-faststart: Check offset_count before reading from the moov_atom buffer

CC: libav-stable at libav.org
Signed-off-by: Martin Storsjö <martin at martin.st>

---

 tools/qt-faststart.c |    8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/tools/qt-faststart.c b/tools/qt-faststart.c
index 5c511a0..792c272 100644
--- a/tools/qt-faststart.c
+++ b/tools/qt-faststart.c
@@ -239,6 +239,10 @@ int main(int argc, char *argv[])
                 goto error_out;
             }
             offset_count = BE_32(&moov_atom[i + 8]);
+            if (i + 12 + offset_count * UINT64_C(4) > moov_atom_size) {
+                printf(" bad atom size/element count\n");
+                goto error_out;
+            }
             for (j = 0; j < offset_count; j++) {
                 current_offset  = BE_32(&moov_atom[i + 12 + j * 4]);
                 current_offset += moov_atom_size;
@@ -256,6 +260,10 @@ int main(int argc, char *argv[])
                 goto error_out;
             }
             offset_count = BE_32(&moov_atom[i + 8]);
+            if (i + 12 + offset_count * UINT64_C(8) > moov_atom_size) {
+                printf(" bad atom size/element count\n");
+                goto error_out;
+            }
             for (j = 0; j < offset_count; j++) {
                 current_offset  = BE_64(&moov_atom[i + 12 + j * 8]);
                 current_offset += moov_atom_size;



More information about the libav-stable mailing list