This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/9.0 in repository ffmpeg.
commit 1f51b7b87fd8184ecff4fd0a6bacbf4ee28ce543 Author: Omkhar Arasaratnam <[email protected]> AuthorDate: Tue Jun 30 21:58:38 2026 +0200 Commit: Michael Niedermayer <[email protected]> CommitDate: Tue Jul 21 22:59:53 2026 +0200 avformat/mov: bound the iref thmb/cdsc entry count by the sub-box size Fixes: excessive parsing past the iref sub-box Fixes: TMwMAJfgy3l9 Fixes: 74e430202d933284fc38b591d4b3a12464e8aec6 (avformat/mov: make items referencing items generic) Found-by: Omkhar Arasaratnam Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit dcc18b60779b0d228b37621b6485cb74b2d6f352) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/mov.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 90b01f9499..4154038d9e 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -9444,10 +9444,11 @@ fail: return ret; } -static int mov_read_iref_cdsc(MOVContext *c, AVIOContext *pb, uint32_t type, int version) +static int mov_read_iref_cdsc(MOVContext *c, AVIOContext *pb, uint32_t type, int version, uint32_t size) { HEIFItem *from_item = NULL; int entries; + int item_id_size = version ? 4 : 2; int from_item_id = version ? avio_rb32(pb) : avio_rb16(pb); const HEIFItemRef ref = { type, from_item_id }; @@ -9458,6 +9459,11 @@ static int mov_read_iref_cdsc(MOVContext *c, AVIOContext *pb, uint32_t type, int } entries = avio_rb16(pb); + if ((int64_t)entries * item_id_size > (int64_t)size - item_id_size - 2) { + av_log(c->fc, AV_LOG_ERROR, "iref %s entry count %d exceeds the sub-box size\n", + av_fourcc2str(type), entries); + return AVERROR_INVALIDDATA; + } /* 'to' item ids */ for (int i = 0; i < entries; i++) { HEIFItem *item = get_heif_item(c, version ? avio_rb32(pb) : avio_rb16(pb)); @@ -9496,13 +9502,13 @@ static int mov_read_iref(MOVContext *c, AVIOContext *pb, MOVAtom atom) } while (atom.size) { - uint32_t type, size = avio_rb32(pb); int64_t next = avio_tell(pb); + uint32_t type, size = avio_rb32(pb); - if (size < 14 || next < 0 || next > INT64_MAX - size) + if (size < 14 || size > atom.size || next > INT64_MAX - size) return AVERROR_INVALIDDATA; - next += size - 4; + next += size; type = avio_rl32(pb); switch (type) { case MKTAG('d','i','m','g'): @@ -9512,7 +9518,7 @@ static int mov_read_iref(MOVContext *c, AVIOContext *pb, MOVAtom atom) break; case MKTAG('c','d','s','c'): case MKTAG('t','h','m','b'): - ret = mov_read_iref_cdsc(c, pb, type, version); + ret = mov_read_iref_cdsc(c, pb, type, version, size - 8); if (ret < 0) return ret; break; _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
