Commit 866b7cee authored by Rémi Denis-Courmont's avatar Rémi Denis-Courmont

mp4: check STTS size before allocation

This avoids allocating stupid amounts of memory.

Note: there is still an infinite loop if count == 0xffffffff
(with a suitably enormous input).
parent 94f3a340
......@@ -1546,31 +1546,35 @@ static void MP4_FreeBox_stts( MP4_Box_t *p_box )
static int MP4_ReadBox_stts( stream_t *p_stream, MP4_Box_t *p_box )
{
uint32_t count;
MP4_READBOX_ENTER( MP4_Box_data_stts_t, MP4_FreeBox_stts );
MP4_GETVERSIONFLAGS( p_box->data.p_stts );
MP4_GET4BYTES( p_box->data.p_stts->i_entry_count );
MP4_GET4BYTES( count );
if( UINT64_C(8) * count > (uint64_t)i_read )
{
/*count = i_read / 8;*/
MP4_READBOX_EXIT( 0 );
}
p_box->data.p_stts->pi_sample_count = vlc_alloc( count, sizeof(uint32_t) );
p_box->data.p_stts->pi_sample_delta = vlc_alloc( count, sizeof(int32_t) );
p_box->data.p_stts->i_entry_count = count;
p_box->data.p_stts->pi_sample_count =
calloc( p_box->data.p_stts->i_entry_count, sizeof(uint32_t) );
p_box->data.p_stts->pi_sample_delta =
calloc( p_box->data.p_stts->i_entry_count, sizeof(int32_t) );
if( p_box->data.p_stts->pi_sample_count == NULL
|| p_box->data.p_stts->pi_sample_delta == NULL )
{
MP4_READBOX_EXIT( 0 );
}
uint32_t i = 0;
for( ; (i < p_box->data.p_stts->i_entry_count )&&( i_read >=8 ); i++ )
for( uint32_t i = 0; i < count; i++ )
{
MP4_GET4BYTES( p_box->data.p_stts->pi_sample_count[i] );
MP4_GET4BYTES( p_box->data.p_stts->pi_sample_delta[i] );
}
if ( i < p_box->data.p_stts->i_entry_count )
p_box->data.p_stts->i_entry_count = i;
#ifdef MP4_VERBOSE
msg_Dbg( p_stream, "read box: \"stts\" entry-count %d",
p_box->data.p_stts->i_entry_count );
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment