Stowage/ffmpeg
2
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-06-04 22:50:24 +00:00
Code Issues Projects Releases Packages Wiki Activity

avformat/mov: Limit maximum box size for mov_read_lhvc()

Browse source 
Signed-off-by: Dale Curtis <dalecurtis@chromium.org>
This commit is contained in:
Dale Curtis 2026-04-22 20:19:02 +00:00 • committed by James Almer
parent e294b390a0
commit a7d42bfba8
1 changed files with 3 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
libavformat/mov.c
View file

@ -8683,8 +8683,10 @@ static int mov_read_lhvc(MOVContext *c, AVIOContext *pb, MOVAtom atom)
// TODO: handle lhvC when present before hvcC
return 0;
if (atom.size < 6 || st->codecpar->extradata_size < 23)
if (atom.size < 6 || st->codecpar->extradata_size < 23 ||
atom.size > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE) {
return AVERROR_INVALIDDATA;
}
buf = av_malloc(atom.size + AV_INPUT_BUFFER_PADDING_SIZE);
if (!buf)