From 28b1dbb4ee23e471bb1f8e6e6e6a46ce59a2dcce Mon Sep 17 00:00:00 2001 From: James Almer Date: Sun, 30 Jun 2024 23:40:22 -0300 Subject: [PATCH] avformat/mov: add more checks for infe atom size Signed-off-by: James Almer --- libavformat/mov.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavformat/mov.c b/libavformat/mov.c index 2c47610d0e..be8add7603 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -8132,6 +8132,8 @@ static int mov_read_infe(MOVContext *c, AVIOContext *pb, MOVAtom atom, int idx) version = avio_r8(pb); avio_rb24(pb); // flags. size -= 4; + if (size < 0) + return AVERROR_INVALIDDATA; if (version < 2) { avpriv_report_missing_feature(c->fc, "infe version < 2"); @@ -8143,6 +8145,8 @@ static int mov_read_infe(MOVContext *c, AVIOContext *pb, MOVAtom atom, int idx) avio_rb16(pb); // item_protection_index item_type = avio_rl32(pb); size -= 8; + if (size < 1) + return AVERROR_INVALIDDATA; av_bprint_init(&item_name, 0, AV_BPRINT_SIZE_UNLIMITED); ret = ff_read_string_to_bprint_overwrite(pb, &item_name, size);