Thanks for the quick feed back! I attached a small sample file, the media was generated with Davinci Resolve.
On Wed, Aug 6, 2014 at 3:00 PM, Michael Niedermayer <michae...@gmx.at>
wrote:
> On Wed, Aug 06, 2014 at 01:25:08PM -0700, Mark Reid wrote:
> > ---
> > libavformat/mov.c | 20 ++++++++++++++++++++
> > 1 file changed, 20 insertions(+)
>
> do you have a sample / testcase that you can share ?
>
>
> >
> > diff --git a/libavformat/mov.c b/libavformat/mov.c
> > index ab85918..fb8d1fe 100644
> > --- a/libavformat/mov.c
> > +++ b/libavformat/mov.c
> > @@ -1529,6 +1529,26 @@ static int mov_parse_stsd_data(MOVContext *c,
> AVIOContext *pb,
> > st->codec->flags2 |= CODEC_FLAG2_DROP_FRAME_TIMECODE;
> > st->codec->time_base.den = st->codec->extradata[16]; /*
> number of frame */
> > st->codec->time_base.num = 1;
> > + if (size > 26) {
> > + uint32_t len = AV_RB32(st->codec->extradata + 18); /*
> name atom length */
> > + uint32_t format = AV_RB32(st->codec->extradata + 22);
>
> > + if (format == AV_RB32("name") && size >= 18 + len) {
>
> 18 + len can overflow
>
>
> > + uint16_t str_size = AV_RB16(st->codec->extradata +
> 26); /* string length */
> > + char *reel_name = av_malloc(str_size + 1);
> > + if (!reel_name)
> > + return AVERROR(ENOMEM);
> > + memcpy(reel_name, st->codec->extradata + 30,
> str_size);
>
> this accesses extradata + 30, but the check is just for 26
>
>
> > + reel_name[str_size] = 0; /* Add null terminator */
> > + /* don't add reel_name if emtpy string */
>
> > + if (strcmp(reel_name, "") == 0) {
>
> *reel_name == 0
>
> [...]
>
> --
> Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB
>
> Avoid a single point of failure, be that a person or equipment.
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
>
example_reel_name.mov
Description: QuickTime movie
_______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
