Commit cab39afb authored by Mark Reid's avatar Mark Reid Committed by Michael Niedermayer

avformat/movenc: check that reel_name length doesn't exceed UINT16_MAX

Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parent bd879652
......@@ -1340,13 +1340,22 @@ static int mov_write_rtp_tag(AVIOContext *pb, MOVTrack *track)
return update_size(pb, pos);
}
static int mov_write_source_reference_tag(AVIOContext *pb, MOVTrack *track, const char *reel_name){
static int mov_write_source_reference_tag(AVIOContext *pb, MOVTrack *track, const char *reel_name)
{
uint64_t str_size =strlen(reel_name);
int64_t pos = avio_tell(pb);
if (str_size >= UINT16_MAX){
av_log(NULL, AV_LOG_ERROR, "reel_name length %llu is too large\n", str_size);
avio_wb16(pb, 0);
return AVERROR(EINVAL);
}
avio_wb32(pb, 0); /* size */
ffio_wfourcc(pb, "name"); /* Data format */
avio_wb16(pb, strlen(reel_name)); /* string size */
avio_wb16(pb, str_size); /* string size */
avio_wb16(pb, track->language); /* langcode */
avio_write(pb, reel_name, strlen(reel_name)); /* reel name */
avio_write(pb, reel_name, str_size); /* reel name */
return update_size(pb,pos);
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment