PR #23667 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23667 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23667.patch
Fixes: excessive parsing past the iref sub-box Fixes: TMwMAJfgy3l9 Fixes: 74e430202d933284fc38b591d4b3a12464e8aec6 (avformat/mov: make items referencing items generic) Found-by: Omkhar Arasaratnam Signed-off-by: Michael Niedermayer <[email protected]> >From be0f21067eba05b1565040eb751f6cc89092f504 Mon Sep 17 00:00:00 2001 From: Omkhar Arasaratnam <[email protected]> Date: Tue, 30 Jun 2026 21:58:38 +0200 Subject: [PATCH] avformat/mov: bound the iref thmb/cdsc entry count by the sub-box size Fixes: excessive parsing past the iref sub-box Fixes: TMwMAJfgy3l9 Fixes: 74e430202d933284fc38b591d4b3a12464e8aec6 (avformat/mov: make items referencing items generic) Found-by: Omkhar Arasaratnam Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/mov.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 90b01f9499..9340fc6240 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -9444,10 +9444,11 @@ fail: return ret; } -static int mov_read_iref_cdsc(MOVContext *c, AVIOContext *pb, uint32_t type, int version) +static int mov_read_iref_cdsc(MOVContext *c, AVIOContext *pb, uint32_t type, int version, uint32_t size) { HEIFItem *from_item = NULL; int entries; + int item_id_size = version ? 4 : 2; int from_item_id = version ? avio_rb32(pb) : avio_rb16(pb); const HEIFItemRef ref = { type, from_item_id }; @@ -9458,6 +9459,11 @@ static int mov_read_iref_cdsc(MOVContext *c, AVIOContext *pb, uint32_t type, int } entries = avio_rb16(pb); + if ((int64_t)entries * item_id_size > (int64_t)size - 8 - item_id_size - 2) { + av_log(c->fc, AV_LOG_ERROR, "iref %s entry count %d exceeds the sub-box size\n", + av_fourcc2str(type), entries); + return AVERROR_INVALIDDATA; + } /* 'to' item ids */ for (int i = 0; i < entries; i++) { HEIFItem *item = get_heif_item(c, version ? avio_rb32(pb) : avio_rb16(pb)); @@ -9512,7 +9518,7 @@ static int mov_read_iref(MOVContext *c, AVIOContext *pb, MOVAtom atom) break; case MKTAG('c','d','s','c'): case MKTAG('t','h','m','b'): - ret = mov_read_iref_cdsc(c, pb, type, version); + ret = mov_read_iref_cdsc(c, pb, type, version, size); if (ret < 0) return ret; break; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
