diff options
author | Michael Niedermayer <michael@niedermayer.cc> | 2018-03-16 19:53:36 +0100 |
---|---|---|
committer | Michael Niedermayer <michael@niedermayer.cc> | 2018-03-20 22:59:40 +0100 |
commit | 9e67447a4ffacf28af8bace33faf3ea432ddc43e (patch) | |
tree | 6c3a40ebfdf7d48944568a6c0d425ffa1c42f540 /libavformat | |
parent | f6ea397d0ae4e4188e90deecbcffd1cf5419c110 (diff) | |
download | ffmpeg-streaming-9e67447a4ffacf28af8bace33faf3ea432ddc43e.zip ffmpeg-streaming-9e67447a4ffacf28af8bace33faf3ea432ddc43e.tar.gz |
avformat/mov: Check STSC and remove invalid entries
Fixes assertion failure
Fixes: crbug 822547, crbug 822666 and crbug 823009
Affects: aark15sd_9A62E2FA.mp4
Found-by: ClusterFuzz
Reviewed-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavformat')
-rw-r--r-- | libavformat/mov.c | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/libavformat/mov.c b/libavformat/mov.c index b7f9c0c..3312678 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -2630,6 +2630,21 @@ static int mov_read_stsc(MOVContext *c, AVIOContext *pb, MOVAtom atom) } sc->stsc_count = i; + for (i = sc->stsc_count - 1; i < UINT_MAX; i--) { + if ((i+1 < sc->stsc_count && sc->stsc_data[i].first >= sc->stsc_data[i+1].first) || + (i > 0 && sc->stsc_data[i].first <= sc->stsc_data[i-1].first) || + sc->stsc_data[i].first < 1 || + sc->stsc_data[i].count < 1 || + sc->stsc_data[i].id < 1) { + av_log(c->fc, AV_LOG_WARNING, "STSC entry %d is invalid (first=%d count=%d id=%d)\n", i, sc->stsc_data[i].first, sc->stsc_data[i].count, sc->stsc_data[i].id); + if (i+1 >= sc->stsc_count || sc->stsc_data[i+1].first < 2) + return AVERROR_INVALIDDATA; + // We replace this entry by the next valid + sc->stsc_data[i].first = sc->stsc_data[i+1].first - 1; + sc->stsc_data[i].count = sc->stsc_data[i+1].count; + sc->stsc_data[i].id = sc->stsc_data[i+1].id; + } + } if (pb->eof_reached) { av_log(c->fc, AV_LOG_WARNING, "reached eof, corrupted STSC atom\n"); @@ -4119,6 +4134,11 @@ static int mov_read_trak(MOVContext *c, AVIOContext *pb, MOVAtom atom) st->index); return 0; } + if (sc->stsc_count && sc->stsc_data[ sc->stsc_count - 1 ].first > sc->chunk_count) { + av_log(c->fc, AV_LOG_ERROR, "stream %d, contradictionary STSC and STCO\n", + st->index); + return AVERROR_INVALIDDATA; + } fix_timescale(c, sc); |