gsf: check str len of string list property

ossfuzz issue 68297
gpac · May 13, 2024 · 322bb25 · 322bb25
1 parent 789bf66
commit 322bb25
Showing 1 changed file with 10 additions and 0 deletions.
diff --git a/src/filters/dmx_gsf.c b/src/filters/dmx_gsf.c
@@ -349,6 +349,16 @@ static GF_Err gsfdmx_read_prop(GF_BitStream *bs, GF_PropertyValue *p)
 		p->value.string_list.vals = gf_malloc(sizeof(char*) * len2);
 		for (i=0; i<len2; i++) {
 			len = gsfdmx_read_vlen(bs);
+			if (len >= GF_UINT_MAX-1) {
+				for (u32 j=0; j<i; j++) {
+					gf_free(p->value.string_list.vals[j]);
+					p->value.string_list.vals[j] = NULL;
+				}
+				p->value.string_list.nb_items = 0;
+				gf_free(p->value.string_list.vals);
+				GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[GSFDemux] invalid string length in string list property\n"));
+				return GF_NON_COMPLIANT_BITSTREAM;
+			}
 			char *str = gf_malloc(sizeof(char)*(len+1));
 			gf_bs_read_data(bs, str, len);
 			str[len] = 0;