From e4bc8af1e687efb2a2c41a469ac7b31f1c3d48cd Mon Sep 17 00:00:00 2001 From: Baptiste Coudurier Date: Mon, 7 Sep 2009 22:42:51 +0000 Subject: [PATCH] check entries against field_size, potential malloc overflow in read_stsz, fix #1357 Originally committed as revision 19793 to svn://svn.ffmpeg.org/ffmpeg/trunk --- libavformat/mov.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 5f11ebe..05fdfa3 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -1256,7 +1256,7 @@ static int mov_read_stsz(MOVContext *c, ByteIOContext *pb, MOVAtom atom) return -1; } - if(entries >= UINT_MAX / sizeof(int)) + if (entries >= UINT_MAX / sizeof(int) || entries >= (UINT_MAX - 4) / field_size) return -1; sc->sample_sizes = av_malloc(entries * sizeof(int)); if (!sc->sample_sizes) -- 2.7.4