From bb95334c34d0d9abccea370ae25c4765d7764ab8 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michaelni@gmx.at>
Date: Thu, 13 Dec 2012 15:07:20 +0100
Subject: [PATCH] qt-faststart: Check offset_count before reading from the
moov_atom buffer
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
---
tools/qt-faststart.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/tools/qt-faststart.c b/tools/qt-faststart.c
index 5c511a01548..792c2721936 100644
--- a/tools/qt-faststart.c
+++ b/tools/qt-faststart.c
@@ -239,6 +239,10 @@ int main(int argc, char *argv[])
goto error_out;
}
offset_count = BE_32(&moov_atom[i + 8]);
+ if (i + 12 + offset_count * UINT64_C(4) > moov_atom_size) {
+ printf(" bad atom size/element count\n");
+ goto error_out;
+ }
for (j = 0; j < offset_count; j++) {
current_offset = BE_32(&moov_atom[i + 12 + j * 4]);
current_offset += moov_atom_size;
@@ -256,6 +260,10 @@ int main(int argc, char *argv[])
goto error_out;
}
offset_count = BE_32(&moov_atom[i + 8]);
+ if (i + 12 + offset_count * UINT64_C(8) > moov_atom_size) {
+ printf(" bad atom size/element count\n");
+ goto error_out;
+ }
for (j = 0; j < offset_count; j++) {
current_offset = BE_64(&moov_atom[i + 12 + j * 8]);
current_offset += moov_atom_size;
--
GitLab