[vlc-commits] mp4: check STTS size before allocation

[Rémi Denis-Courmont]

vlc | branch: master | Rémi Denis-Courmont <remi at remlab.net> | Fri Nov 24 20:01:01 2017 +0200| [866b7cee553b868e7379a6282c300c3f6f37c137] | committer: Rémi Denis-Courmont

mp4: check STTS size before allocation

This avoids allocating stupid amounts of memory.

Note: there is still an infinite loop if count == 0xffffffff
(with a suitably enormous input).

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=866b7cee553b868e7379a6282c300c3f6f37c137
---

 modules/demux/mp4/libmp4.c | 24 ++++++++++++++----------
 1 file changed, 14 insertions(+), 10 deletions(-)

diff --git a/modules/demux/mp4/libmp4.c b/modules/demux/mp4/libmp4.c
index ee6ff3d132..ef77b6ea32 100644
--- a/modules/demux/mp4/libmp4.c
+++ b/modules/demux/mp4/libmp4.c
@@ -1546,31 +1546,35 @@ static void MP4_FreeBox_stts( MP4_Box_t *p_box )
 
 static int MP4_ReadBox_stts( stream_t *p_stream, MP4_Box_t *p_box )
 {
+    uint32_t count;
+
     MP4_READBOX_ENTER( MP4_Box_data_stts_t, MP4_FreeBox_stts );
 
     MP4_GETVERSIONFLAGS( p_box->data.p_stts );
-    MP4_GET4BYTES( p_box->data.p_stts->i_entry_count );
+    MP4_GET4BYTES( count );
+
+    if( UINT64_C(8) * count > (uint64_t)i_read )
+    {
+        /*count = i_read / 8;*/
+        MP4_READBOX_EXIT( 0 );
+    }
+
+    p_box->data.p_stts->pi_sample_count = vlc_alloc( count, sizeof(uint32_t) );
+    p_box->data.p_stts->pi_sample_delta = vlc_alloc( count, sizeof(int32_t) );
+    p_box->data.p_stts->i_entry_count = count;
 
-    p_box->data.p_stts->pi_sample_count =
-        calloc( p_box->data.p_stts->i_entry_count, sizeof(uint32_t) );
-    p_box->data.p_stts->pi_sample_delta =
-        calloc( p_box->data.p_stts->i_entry_count, sizeof(int32_t) );
     if( p_box->data.p_stts->pi_sample_count == NULL
      || p_box->data.p_stts->pi_sample_delta == NULL )
     {
         MP4_READBOX_EXIT( 0 );
     }
 
-    uint32_t i = 0;
-    for( ; (i < p_box->data.p_stts->i_entry_count )&&( i_read >=8 ); i++ )
+    for( uint32_t i = 0; i < count; i++ )
     {
         MP4_GET4BYTES( p_box->data.p_stts->pi_sample_count[i] );
         MP4_GET4BYTES( p_box->data.p_stts->pi_sample_delta[i] );
     }
 
-    if ( i < p_box->data.p_stts->i_entry_count )
-        p_box->data.p_stts->i_entry_count = i;
-
 #ifdef MP4_VERBOSE
     msg_Dbg( p_stream, "read box: \"stts\" entry-count %d",
                       p_box->data.p_stts->i_entry_count );