From e4bc8af1e687efb2a2c41a469ac7b31f1c3d48cd Mon Sep 17 00:00:00 2001
From: Baptiste Coudurier <baptiste.coudurier@gmail.com>
Date: Mon, 7 Sep 2009 22:42:51 +0000
Subject: [PATCH] check entries against field_size, potential malloc overflow
in read_stsz, fix #1357
Originally committed as revision 19793 to svn://svn.ffmpeg.org/ffmpeg/trunk
---
libavformat/mov.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 5f11ebe711b..05fdfa33362 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -1256,7 +1256,7 @@ static int mov_read_stsz(MOVContext *c, ByteIOContext *pb, MOVAtom atom)
return -1;
}
- if(entries >= UINT_MAX / sizeof(int))
+ if (entries >= UINT_MAX / sizeof(int) || entries >= (UINT_MAX - 4) / field_size)
return -1;
sc->sample_sizes = av_malloc(entries * sizeof(int));
if (!sc->sample_sizes)
--
GitLab