ffmpeg | branch: master | Jacob Trimble <modmaker-at-google....@ffmpeg.org> | Tue Jun 12 14:26:20 2018 -0700| [4aba45ca1fece6be425d168c05aa3a7f9f05da36] | committer: Michael Niedermayer
avformat/mov: Add check for per-sample IV size. Found by Chrome's ClusterFuzz: http://crbug.com/849062. Signed-off-by: Jacob Trimble <modma...@google.com> Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4aba45ca1fece6be425d168c05aa3a7f9f05da36 --- libavformat/mov.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 2fca025889..5d9ffa69a3 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -6273,8 +6273,13 @@ static int mov_read_tenc(MOVContext *c, AVIOContext *pb, MOVAtom atom) return AVERROR(ENOMEM); } sc->cenc.per_sample_iv_size = avio_r8(pb); + if (sc->cenc.per_sample_iv_size != 0 && sc->cenc.per_sample_iv_size != 8 && + sc->cenc.per_sample_iv_size != 16) { + av_log(c->fc, AV_LOG_ERROR, "invalid per-sample IV size value\n"); + return AVERROR_INVALIDDATA; + } if (avio_read(pb, sc->cenc.default_encrypted_sample->key_id, 16) != 16) { - av_log(c->fc, AV_LOG_ERROR, "failed to read the default key ID"); + av_log(c->fc, AV_LOG_ERROR, "failed to read the default key ID\n"); return AVERROR_INVALIDDATA; } @@ -6286,7 +6291,7 @@ static int mov_read_tenc(MOVContext *c, AVIOContext *pb, MOVAtom atom) } if (avio_read(pb, sc->cenc.default_encrypted_sample->iv, iv_size) != iv_size) { - av_log(c->fc, AV_LOG_ERROR, "failed to read the default IV"); + av_log(c->fc, AV_LOG_ERROR, "failed to read the default IV\n"); return AVERROR_INVALIDDATA; } } _______________________________________________ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog