vlc/vlc-2.2 | branch: master | Francois Cartegnie <[email protected]> | Mon Sep 22 21:10:43 2014 +0200| [6f1e0a1c8e13411e3d1508484756bdf1e76a133f] | committer: Jean-Baptiste Kempf
demux: mp4: fix heap read overflow in avcc (fix #12267) (cherry picked from commit 8063cb85bb9adf5c9147336c13d2ba5696e6f3e2) Signed-off-by: Jean-Baptiste Kempf <[email protected]> > http://git.videolan.org/gitweb.cgi/vlc/vlc-2.2.git/?a=commit;h=6f1e0a1c8e13411e3d1508484756bdf1e76a133f --- modules/demux/mp4/libmp4.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/modules/demux/mp4/libmp4.c b/modules/demux/mp4/libmp4.c index 1bafd13..e5e9697 100644 --- a/modules/demux/mp4/libmp4.c +++ b/modules/demux/mp4/libmp4.c @@ -1396,9 +1396,11 @@ static int MP4_ReadBox_avcC( stream_t *p_stream, MP4_Box_t *p_box ) if( !p_avcC->i_sps_length || !p_avcC->sps ) goto error; - for( i = 0; i < p_avcC->i_sps; i++ ) + for( i = 0; i < p_avcC->i_sps && i_read; i++ ) { MP4_GET2BYTES( p_avcC->i_sps_length[i] ); + if ( p_avcC->i_sps_length[i] > i_read ) + goto error; p_avcC->sps[i] = malloc( p_avcC->i_sps_length[i] ); if( p_avcC->sps[i] ) memcpy( p_avcC->sps[i], p_peek, p_avcC->i_sps_length[i] ); @@ -1406,6 +1408,8 @@ static int MP4_ReadBox_avcC( stream_t *p_stream, MP4_Box_t *p_box ) p_peek += p_avcC->i_sps_length[i]; i_read -= p_avcC->i_sps_length[i]; } + if ( i != p_avcC->i_sps ) + goto error; } MP4_GET1BYTE( p_avcC->i_pps ); @@ -1417,9 +1421,11 @@ static int MP4_ReadBox_avcC( stream_t *p_stream, MP4_Box_t *p_box ) if( !p_avcC->i_pps_length || !p_avcC->pps ) goto error; - for( i = 0; i < p_avcC->i_pps; i++ ) + for( i = 0; i < p_avcC->i_pps && i_read; i++ ) { MP4_GET2BYTES( p_avcC->i_pps_length[i] ); + if( p_avcC->i_pps_length[i] > i_read ) + goto error; p_avcC->pps[i] = malloc( p_avcC->i_pps_length[i] ); if( p_avcC->pps[i] ) memcpy( p_avcC->pps[i], p_peek, p_avcC->i_pps_length[i] ); @@ -1427,6 +1433,8 @@ static int MP4_ReadBox_avcC( stream_t *p_stream, MP4_Box_t *p_box ) p_peek += p_avcC->i_pps_length[i]; i_read -= p_avcC->i_pps_length[i]; } + if ( i != p_avcC->i_pps ) + goto error; } #ifdef MP4_VERBOSE msg_Dbg( p_stream, @@ -1449,6 +1457,7 @@ static int MP4_ReadBox_avcC( stream_t *p_stream, MP4_Box_t *p_box ) MP4_READBOX_EXIT( 1 ); error: + MP4_FreeBox_avcC( p_box ); MP4_READBOX_EXIT( 0 ); } _______________________________________________ vlc-commits mailing list [email protected] https://mailman.videolan.org/listinfo/vlc-commits
