sysutils/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-10-24 02:09:03 +03:00
Code Activity

avformat/mov: Allocate the array without clearing before read

Browse Source 
Fixes: OOM
Fixes: poc-keys-count-16777216-inflated-sizes.mp4
Fixes: hKO4f7GYoUd0
(cherry picked from commit 01c3721851)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2026-09-05 23:07:24 +02:00
parent eb25744dd7
commit b39ec3fc30
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
libavformat/mov.c
View File

@@ -5491,14 +5491,17 @@ static int mov_read_keys(MOVContext *c, AVIOContext *pb, MOVAtom atom)
return AVERROR_INVALIDDATA;
}
c->meta_keys_count = count + 1;
c->meta_keys = av_mallocz(c->meta_keys_count * sizeof(*c->meta_keys));
c->meta_keys = av_malloc_array(count + 1, sizeof(*c->meta_keys));
if (!c->meta_keys)
return AVERROR(ENOMEM);
c->meta_keys[0] = NULL;
c->meta_keys_count = 1;
for (i = 1; i <= count; ++i) {
uint32_t key_size = avio_rb32(pb);
uint32_t type = avio_rl32(pb);
c->meta_keys[i] = NULL;
c->meta_keys_count = i + 1;
if (key_size < 8 || key_size > atom.size) {
av_log(c->fc, AV_LOG_ERROR,
"The key# %"PRIu32" in meta has invalid size:"