Skip to content

F
ffmpeg.wasm-core
Commit 5ab882d7 authored by Clément Bœsch's avatar Clément Bœsch
Browse files
Options

avformat/mov: strengthen some table allocations

parent 98e8a9e2
Hide whitespace changes
Inline Side-by-side
Showing with 27 additions and 21 deletions
libavformat/mov.c
View file @ 5ab882d7
...@@ -1272,14 +1272,12 @@ static int mov_read_stco(MOVContext *c, AVIOContext *pb, MOVAtom atom) ...@@ -1272,14 +1272,12 @@ static int mov_read_stco(MOVContext *c, AVIOContext *pb, MOVAtom atom)
if (!entries) if (!entries)
return 0; return 0;
if (entries >= UINT_MAX/sizeof(int64_t))
return AVERROR_INVALIDDATA;
if (sc->chunk_offsets) if (sc->chunk_offsets)
av_log(c->fc, AV_LOG_WARNING, "Duplicate STCO atom\n"); av_log(c->fc, AV_LOG_WARNING, "Duplicate STCO atom\n");
av_free(sc->chunk_offsets); av_free(sc->chunk_offsets);
sc->chunk_count = 0; sc->chunk_count = 0;
sc->chunk_offsets = av_malloc(entries * sizeof(int64_t)); sc->chunk_offsets = av_malloc_array(entries, sizeof(*sc->chunk_offsets));
if (!sc->chunk_offsets) if (!sc->chunk_offsets)
return AVERROR(ENOMEM); return AVERROR(ENOMEM);
sc->chunk_count = entries; sc->chunk_count = entries;
...@@ -1873,13 +1871,11 @@ static int mov_read_stsc(MOVContext *c, AVIOContext *pb, MOVAtom atom) ...@@ -1873,13 +1871,11 @@ static int mov_read_stsc(MOVContext *c, AVIOContext *pb, MOVAtom atom)
if (!entries) if (!entries)
return 0; return 0;
if (entries >= UINT_MAX / sizeof(*sc->stsc_data))
return AVERROR_INVALIDDATA;
if (sc->stsc_data) if (sc->stsc_data)
av_log(c->fc, AV_LOG_WARNING, "Duplicate STSC atom\n"); av_log(c->fc, AV_LOG_WARNING, "Duplicate STSC atom\n");
av_free(sc->stsc_data); av_free(sc->stsc_data);
sc->stsc_count = 0; sc->stsc_count = 0;
sc->stsc_data = av_malloc(entries * sizeof(*sc->stsc_data)); sc->stsc_data = av_malloc_array(entries, sizeof(*sc->stsc_data));
if (!sc->stsc_data) if (!sc->stsc_data)
return AVERROR(ENOMEM); return AVERROR(ENOMEM);
...@@ -1911,9 +1907,11 @@ static int mov_read_stps(MOVContext *c, AVIOContext *pb, MOVAtom atom) ...@@ -1911,9 +1907,11 @@ static int mov_read_stps(MOVContext *c, AVIOContext *pb, MOVAtom atom)
avio_rb32(pb); // version + flags avio_rb32(pb); // version + flags
entries = avio_rb32(pb); entries = avio_rb32(pb);
if (entries >= UINT_MAX / sizeof(*sc->stps_data)) if (sc->stps_data)
return AVERROR_INVALIDDATA; av_log(c->fc, AV_LOG_WARNING, "Duplicate STPS atom\n");
sc->stps_data = av_malloc(entries * sizeof(*sc->stps_data)); av_free(sc->stps_data);
sc->stps_count = 0;
sc->stps_data = av_malloc_array(entries, sizeof(*sc->stps_data));
if (!sc->stps_data) if (!sc->stps_data)
return AVERROR(ENOMEM); return AVERROR(ENOMEM);
...@@ -1955,9 +1953,11 @@ static int mov_read_stss(MOVContext *c, AVIOContext *pb, MOVAtom atom) ...@@ -1955,9 +1953,11 @@ static int mov_read_stss(MOVContext *c, AVIOContext *pb, MOVAtom atom)
st->need_parsing = AVSTREAM_PARSE_HEADERS; st->need_parsing = AVSTREAM_PARSE_HEADERS;
return 0; return 0;
} }
if (entries >= UINT_MAX / sizeof(int)) if (sc->keyframes)
return AVERROR_INVALIDDATA; av_log(c->fc, AV_LOG_WARNING, "Duplicate STSS atom\n");
sc->keyframes = av_malloc(entries * sizeof(int)); av_free(sc->keyframes);
sc->keyframe_count = 0;
sc->keyframes = av_malloc_array(entries, sizeof(*sc->keyframes));
if (!sc->keyframes) if (!sc->keyframes)
return AVERROR(ENOMEM); return AVERROR(ENOMEM);
...@@ -2016,9 +2016,13 @@ static int mov_read_stsz(MOVContext *c, AVIOContext *pb, MOVAtom atom) ...@@ -2016,9 +2016,13 @@ static int mov_read_stsz(MOVContext *c, AVIOContext *pb, MOVAtom atom)
if (!entries) if (!entries)
return 0; return 0;
if (entries >= UINT_MAX / sizeof(int) || entries >= (UINT_MAX - 4) / field_size) if (entries >= (UINT_MAX - 4) / field_size)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
sc->sample_sizes = av_malloc(entries * sizeof(int)); if (sc->sample_sizes)
av_log(c->fc, AV_LOG_WARNING, "Duplicate STSZ atom\n");
av_free(sc->sample_sizes);
sc->sample_count = 0;
sc->sample_sizes = av_malloc_array(entries, sizeof(*sc->sample_sizes));
if (!sc->sample_sizes) if (!sc->sample_sizes)
return AVERROR(ENOMEM); return AVERROR(ENOMEM);
...@@ -2072,11 +2076,11 @@ static int mov_read_stts(MOVContext *c, AVIOContext *pb, MOVAtom atom) ...@@ -2072,11 +2076,11 @@ static int mov_read_stts(MOVContext *c, AVIOContext *pb, MOVAtom atom)
av_dlog(c->fc, "track[%i].stts.entries = %i\n", av_dlog(c->fc, "track[%i].stts.entries = %i\n",
c->fc->nb_streams-1, entries); c->fc->nb_streams-1, entries);
if (entries >= UINT_MAX / sizeof(*sc->stts_data)) if (sc->stts_data)
return -1; av_log(c->fc, AV_LOG_WARNING, "Duplicate STTS atom\n");
av_free(sc->stts_data); av_free(sc->stts_data);
sc->stts_data = av_malloc(entries * sizeof(*sc->stts_data)); sc->stts_count = 0;
sc->stts_data = av_malloc_array(entries, sizeof(*sc->stts_data));
if (!sc->stts_data) if (!sc->stts_data)
return AVERROR(ENOMEM); return AVERROR(ENOMEM);
...@@ -2215,9 +2219,11 @@ static int mov_read_sbgp(MOVContext *c, AVIOContext *pb, MOVAtom atom) ...@@ -2215,9 +2219,11 @@ static int mov_read_sbgp(MOVContext *c, AVIOContext *pb, MOVAtom atom)
entries = avio_rb32(pb); entries = avio_rb32(pb);
if (!entries) if (!entries)
return 0; return 0;
if (entries >= UINT_MAX / sizeof(*sc->rap_group)) if (sc->rap_group)
return AVERROR_INVALIDDATA; av_log(c->fc, AV_LOG_WARNING, "Duplicate SBGP atom\n");
sc->rap_group = av_malloc(entries * sizeof(*sc->rap_group)); av_free(sc->rap_group);
sc->rap_group_count = 0;
sc->rap_group = av_malloc_array(entries, sizeof(*sc->rap_group));
if (!sc->rap_group) if (!sc->rap_group)
return AVERROR(ENOMEM); return AVERROR(ENOMEM);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment