Skip to content

Commit 900f396

Browse files
孙浩(晓黑)michaelni
孙浩(晓黑)
authored andcommitted
avformat/mxfdec: Fix DoS issues in mxf_read_index_entry_array()
Fixes: 20170829A.mxf Co-Author: 张洪亮(望初)" <wangchu.zhl@alibaba-inc.com> Found-by: Xiaohei and Wangchu from Alibaba Security Team Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
1 parent c24bcb5 commit 900f396

File tree

1 file changed

+4
-0
lines changed

1 file changed

+4
-0
lines changed

Diff for: libavformat/mxfdec.c

+4
Original file line numberDiff line numberDiff line change
@@ -899,6 +899,8 @@ static int mxf_read_index_entry_array(AVIOContext *pb, MXFIndexTableSegment *seg
899899
segment->nb_index_entries = avio_rb32(pb);
900900

901901
length = avio_rb32(pb);
902+
if(segment->nb_index_entries && length < 11)
903+
return AVERROR_INVALIDDATA;
902904

903905
if (!(segment->temporal_offset_entries=av_calloc(segment->nb_index_entries, sizeof(*segment->temporal_offset_entries))) ||
904906
!(segment->flag_entries = av_calloc(segment->nb_index_entries, sizeof(*segment->flag_entries))) ||
@@ -909,6 +911,8 @@ static int mxf_read_index_entry_array(AVIOContext *pb, MXFIndexTableSegment *seg
909911
}
910912

911913
for (i = 0; i < segment->nb_index_entries; i++) {
914+
if(avio_feof(pb))
915+
return AVERROR_INVALIDDATA;
912916
segment->temporal_offset_entries[i] = avio_r8(pb);
913917
avio_r8(pb); /* KeyFrameOffset */
914918
segment->flag_entries[i] = avio_r8(pb);

0 commit comments

Comments
 (0)