Commit 01c4480f authored by Rémi Denis-Courmont's avatar Rémi Denis-Courmont

mp4: check STSS size before allocation

This avoids allocating stupid amounts of memory.

Note: there is still an infinite loop if count == 0xffffffff
(with a suitably enormous input).
parent 90e61008
......@@ -3040,27 +3040,27 @@ static void MP4_FreeBox_stss( MP4_Box_t *p_box )
static int MP4_ReadBox_stss( stream_t *p_stream, MP4_Box_t *p_box )
{
uint32_t count;
MP4_READBOX_ENTER( MP4_Box_data_stss_t, MP4_FreeBox_stss );
MP4_GETVERSIONFLAGS( p_box->data.p_stss );
MP4_GET4BYTES( count );
MP4_GET4BYTES( p_box->data.p_stss->i_entry_count );
if( UINT64_C(4) * count > i_read )
MP4_READBOX_EXIT( 0 );
p_box->data.p_stss->i_sample_number =
calloc( p_box->data.p_stss->i_entry_count, sizeof(uint32_t) );
p_box->data.p_stss->i_sample_number = vlc_alloc( count, sizeof(uint32_t) );
if( unlikely( p_box->data.p_stss->i_sample_number == NULL ) )
MP4_READBOX_EXIT( 0 );
p_box->data.p_stss->i_entry_count = count;
unsigned int i;
for( i = 0; (i < p_box->data.p_stss->i_entry_count )&&( i_read >= 4 ); i++ )
for( uint32_t i = 0; i < count; i++ )
{
MP4_GET4BYTES( p_box->data.p_stss->i_sample_number[i] );
/* XXX in libmp4 sample begin at 0 */
p_box->data.p_stss->i_sample_number[i]--;
}
if ( i < p_box->data.p_stss->i_entry_count )
p_box->data.p_stss->i_entry_count = i;
#ifdef MP4_VERBOSE
msg_Dbg( p_stream, "read box: \"stss\" entry-count %d",
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment