Re: [libav-devel] [PATCH] mov: Validate stsc indexes are within stsd bounds

[Vittorio Giovara]

On Mon, Jun 6, 2016 at 1:26 PM, Luca Barbato  wrote:
> On 06/06/16 18:47, Vittorio Giovara wrote:
>> ---
>>  libavformat/mov.c | 2 ++
>>  1 file changed, 2 insertions(+)
>>
>> diff --git a/libavformat/mov.c b/libavformat/mov.c
>> index fceef5b..385bd1d 100644
>> --- a/libavformat/mov.c
>> +++ b/libavformat/mov.c
>> @@ -1952,6 +1952,8 @@ static int mov_read_stsc(MOVContext *c, AVIOContext 
>> *pb, MOVAtom atom)
>>  sc->stsc_data[i].first = avio_rb32(pb);
>>  sc->stsc_data[i].count = avio_rb32(pb);
>>  sc->stsc_data[i].id = avio_rb32(pb);
>> +if (sc->stsc_data[i].id > sc->stsd_count)
>> +return AVERROR_INVALIDDATA;
>>  }
>>
>>  sc->stsc_count = i;
>>
>
> Ok
>
> That's a stable candidate =)

we don't use the index for anything in stable, so it's probably ok to
skip this patch there
-- 
Vittorio
___
libav-devel mailing list
libav-devel@libav.org
https://lists.libav.org/mailman/listinfo/libav-devel

Re: [libav-devel] [PATCH] mov: Validate stsc indexes are within stsd bounds

[Luca Barbato]

On 06/06/16 18:47, Vittorio Giovara wrote:
> ---
>  libavformat/mov.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/libavformat/mov.c b/libavformat/mov.c
> index fceef5b..385bd1d 100644
> --- a/libavformat/mov.c
> +++ b/libavformat/mov.c
> @@ -1952,6 +1952,8 @@ static int mov_read_stsc(MOVContext *c, AVIOContext 
> *pb, MOVAtom atom)
>  sc->stsc_data[i].first = avio_rb32(pb);
>  sc->stsc_data[i].count = avio_rb32(pb);
>  sc->stsc_data[i].id = avio_rb32(pb);
> +if (sc->stsc_data[i].id > sc->stsd_count)
> +return AVERROR_INVALIDDATA;
>  }
>  
>  sc->stsc_count = i;
> 

Ok

That's a stable candidate =)

lu
___
libav-devel mailing list
libav-devel@libav.org
https://lists.libav.org/mailman/listinfo/libav-devel

[libav-devel] [PATCH] mov: Validate stsc indexes are within stsd bounds

[Vittorio Giovara]

---
 libavformat/mov.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index fceef5b..385bd1d 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -1952,6 +1952,8 @@ static int mov_read_stsc(MOVContext *c, AVIOContext *pb, 
MOVAtom atom)
 sc->stsc_data[i].first = avio_rb32(pb);
 sc->stsc_data[i].count = avio_rb32(pb);
 sc->stsc_data[i].id = avio_rb32(pb);
+if (sc->stsc_data[i].id > sc->stsd_count)
+return AVERROR_INVALIDDATA;
 }
 
 sc->stsc_count = i;
-- 
2.8.3

___
libav-devel mailing list
libav-devel@libav.org
https://lists.libav.org/mailman/listinfo/libav-devel