PR #24190 opened by Hawthorn URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24190 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24190.patch
mov_read_iloc() and mov_read_iinf() read a 16- or 32-bit item/entry count from the file and pass it straight to av_realloc_array() with no limit, so a small box can drive a large allocation before the read loop hits EOF. Reject counts larger than the remaining box size, matching the existing sgpd bound (a100d346) >From 7d97eda8bcdea97f8ed3293ce05bd0227bc1b37f Mon Sep 17 00:00:00 2001 From: Hawthorn <[email protected]> Date: Mon, 17 Aug 2026 20:09:49 +0530 Subject: [PATCH] avformat/mov: bound iloc/iinf item counts by the box size mov_read_iloc() and mov_read_iinf() read a 16- or 32-bit item/entry count from the file and pass it straight to av_realloc_array() with no limit, so a small box can drive a multi-gigabyte allocation before the read loop hits EOF. Reject counts larger than the remaining box size, matching the existing sgpd bound. Signed-off-by: Hawthorn <[email protected]> --- libavformat/mov.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libavformat/mov.c b/libavformat/mov.c index 5a66d572ee..fcec8d1633 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -9435,6 +9435,9 @@ static int mov_read_iloc(MOVContext *c, AVIOContext *pb, MOVAtom atom) } item_count = (version < 2) ? avio_rb16(pb) : avio_rb32(pb); + if (item_count > atom.size) + return AVERROR_INVALIDDATA; + heif_item = av_realloc_array(c->heif_item, FFMAX(item_count, c->nb_heif_item), sizeof(*c->heif_item)); if (!heif_item) return AVERROR(ENOMEM); @@ -9593,6 +9596,9 @@ static int mov_read_iinf(MOVContext *c, AVIOContext *pb, MOVAtom atom) avio_rb24(pb); // flags. entry_count = version ? avio_rb32(pb) : avio_rb16(pb); + if (entry_count > atom.size) + return AVERROR_INVALIDDATA; + heif_item = av_realloc_array(c->heif_item, FFMAX(entry_count, c->nb_heif_item), sizeof(*c->heif_item)); if (!heif_item) return AVERROR(ENOMEM); -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
