ffmpeg | branch: master | Marton Balint <c...@passwd.hu> | Fri Mar 9 00:46:06 2018 +0100| [cf5ffe0183947112ac50be81942d8be610aa987c] | committer: Marton Balint
avformat/mxfdec: do not allow more partitions than INT_MAX/2 Some math (e.g: partition binary search) overflows if we have that many parititions. Signed-off-by: Marton Balint <c...@passwd.hu> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=cf5ffe0183947112ac50be81942d8be610aa987c --- libavformat/mxfdec.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c index 70091e0dc9..7a42555562 100644 --- a/libavformat/mxfdec.c +++ b/libavformat/mxfdec.c @@ -565,6 +565,9 @@ static int mxf_read_partition_pack(void *arg, AVIOContext *pb, int tag, int size uint64_t footer_partition; uint32_t nb_essence_containers; + if (mxf->partitions_count >= INT_MAX / 2) + return AVERROR_INVALIDDATA; + tmp_part = av_realloc_array(mxf->partitions, mxf->partitions_count + 1, sizeof(*mxf->partitions)); if (!tmp_part) return AVERROR(ENOMEM); _______________________________________________ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
