vlc | branch: master | Rémi Denis-Courmont <[email protected]> | Fri Nov 24 20:01:01 2017 +0200| [866b7cee553b868e7379a6282c300c3f6f37c137] | committer: Rémi Denis-Courmont
mp4: check STTS size before allocation This avoids allocating stupid amounts of memory. Note: there is still an infinite loop if count == 0xffffffff (with a suitably enormous input). > http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=866b7cee553b868e7379a6282c300c3f6f37c137 --- modules/demux/mp4/libmp4.c | 24 ++++++++++++++---------- 1 file changed, 14 insertions(+), 10 deletions(-) diff --git a/modules/demux/mp4/libmp4.c b/modules/demux/mp4/libmp4.c index ee6ff3d132..ef77b6ea32 100644 --- a/modules/demux/mp4/libmp4.c +++ b/modules/demux/mp4/libmp4.c @@ -1546,31 +1546,35 @@ static void MP4_FreeBox_stts( MP4_Box_t *p_box ) static int MP4_ReadBox_stts( stream_t *p_stream, MP4_Box_t *p_box ) { + uint32_t count; + MP4_READBOX_ENTER( MP4_Box_data_stts_t, MP4_FreeBox_stts ); MP4_GETVERSIONFLAGS( p_box->data.p_stts ); - MP4_GET4BYTES( p_box->data.p_stts->i_entry_count ); + MP4_GET4BYTES( count ); + + if( UINT64_C(8) * count > (uint64_t)i_read ) + { + /*count = i_read / 8;*/ + MP4_READBOX_EXIT( 0 ); + } + + p_box->data.p_stts->pi_sample_count = vlc_alloc( count, sizeof(uint32_t) ); + p_box->data.p_stts->pi_sample_delta = vlc_alloc( count, sizeof(int32_t) ); + p_box->data.p_stts->i_entry_count = count; - p_box->data.p_stts->pi_sample_count = - calloc( p_box->data.p_stts->i_entry_count, sizeof(uint32_t) ); - p_box->data.p_stts->pi_sample_delta = - calloc( p_box->data.p_stts->i_entry_count, sizeof(int32_t) ); if( p_box->data.p_stts->pi_sample_count == NULL || p_box->data.p_stts->pi_sample_delta == NULL ) { MP4_READBOX_EXIT( 0 ); } - uint32_t i = 0; - for( ; (i < p_box->data.p_stts->i_entry_count )&&( i_read >=8 ); i++ ) + for( uint32_t i = 0; i < count; i++ ) { MP4_GET4BYTES( p_box->data.p_stts->pi_sample_count[i] ); MP4_GET4BYTES( p_box->data.p_stts->pi_sample_delta[i] ); } - if ( i < p_box->data.p_stts->i_entry_count ) - p_box->data.p_stts->i_entry_count = i; - #ifdef MP4_VERBOSE msg_Dbg( p_stream, "read box: \"stts\" entry-count %d", p_box->data.p_stts->i_entry_count ); _______________________________________________ vlc-commits mailing list [email protected] https://mailman.videolan.org/listinfo/vlc-commits
