[vlc-commits] demux: mp4: fix heap read overflow in avcc (fix #12267)
Francois Cartegnie
git at videolan.org
Wed Sep 24 13:17:34 CEST 2014
vlc/vlc-2.2 | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Mon Sep 22 21:10:43 2014 +0200| [6f1e0a1c8e13411e3d1508484756bdf1e76a133f] | committer: Jean-Baptiste Kempf
demux: mp4: fix heap read overflow in avcc (fix #12267)
(cherry picked from commit 8063cb85bb9adf5c9147336c13d2ba5696e6f3e2)
Signed-off-by: Jean-Baptiste Kempf <jb at videolan.org>
> http://git.videolan.org/gitweb.cgi/vlc/vlc-2.2.git/?a=commit;h=6f1e0a1c8e13411e3d1508484756bdf1e76a133f
---
modules/demux/mp4/libmp4.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/modules/demux/mp4/libmp4.c b/modules/demux/mp4/libmp4.c
index 1bafd13..e5e9697 100644
--- a/modules/demux/mp4/libmp4.c
+++ b/modules/demux/mp4/libmp4.c
@@ -1396,9 +1396,11 @@ static int MP4_ReadBox_avcC( stream_t *p_stream, MP4_Box_t *p_box )
if( !p_avcC->i_sps_length || !p_avcC->sps )
goto error;
- for( i = 0; i < p_avcC->i_sps; i++ )
+ for( i = 0; i < p_avcC->i_sps && i_read; i++ )
{
MP4_GET2BYTES( p_avcC->i_sps_length[i] );
+ if ( p_avcC->i_sps_length[i] > i_read )
+ goto error;
p_avcC->sps[i] = malloc( p_avcC->i_sps_length[i] );
if( p_avcC->sps[i] )
memcpy( p_avcC->sps[i], p_peek, p_avcC->i_sps_length[i] );
@@ -1406,6 +1408,8 @@ static int MP4_ReadBox_avcC( stream_t *p_stream, MP4_Box_t *p_box )
p_peek += p_avcC->i_sps_length[i];
i_read -= p_avcC->i_sps_length[i];
}
+ if ( i != p_avcC->i_sps )
+ goto error;
}
MP4_GET1BYTE( p_avcC->i_pps );
@@ -1417,9 +1421,11 @@ static int MP4_ReadBox_avcC( stream_t *p_stream, MP4_Box_t *p_box )
if( !p_avcC->i_pps_length || !p_avcC->pps )
goto error;
- for( i = 0; i < p_avcC->i_pps; i++ )
+ for( i = 0; i < p_avcC->i_pps && i_read; i++ )
{
MP4_GET2BYTES( p_avcC->i_pps_length[i] );
+ if( p_avcC->i_pps_length[i] > i_read )
+ goto error;
p_avcC->pps[i] = malloc( p_avcC->i_pps_length[i] );
if( p_avcC->pps[i] )
memcpy( p_avcC->pps[i], p_peek, p_avcC->i_pps_length[i] );
@@ -1427,6 +1433,8 @@ static int MP4_ReadBox_avcC( stream_t *p_stream, MP4_Box_t *p_box )
p_peek += p_avcC->i_pps_length[i];
i_read -= p_avcC->i_pps_length[i];
}
+ if ( i != p_avcC->i_pps )
+ goto error;
}
#ifdef MP4_VERBOSE
msg_Dbg( p_stream,
@@ -1449,6 +1457,7 @@ static int MP4_ReadBox_avcC( stream_t *p_stream, MP4_Box_t *p_box )
MP4_READBOX_EXIT( 1 );
error:
+ MP4_FreeBox_avcC( p_box );
MP4_READBOX_EXIT( 0 );
}
More information about the vlc-commits
mailing list