From 4aba45ca1fece6be425d168c05aa3a7f9f05da36 Mon Sep 17 00:00:00 2001 From: Jacob Trimble Date: Tue, 12 Jun 2018 14:26:20 -0700 Subject: avformat/mov: Add check for per-sample IV size. Found by Chrome's ClusterFuzz: http://crbug.com/849062. Signed-off-by: Jacob Trimble Signed-off-by: Michael Niedermayer --- libavformat/mov.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) (limited to 'libavformat') diff --git a/libavformat/mov.c b/libavformat/mov.c index 2fca025889..5d9ffa69a3 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -6273,8 +6273,13 @@ static int mov_read_tenc(MOVContext *c, AVIOContext *pb, MOVAtom atom) return AVERROR(ENOMEM); } sc->cenc.per_sample_iv_size = avio_r8(pb); + if (sc->cenc.per_sample_iv_size != 0 && sc->cenc.per_sample_iv_size != 8 && + sc->cenc.per_sample_iv_size != 16) { + av_log(c->fc, AV_LOG_ERROR, "invalid per-sample IV size value\n"); + return AVERROR_INVALIDDATA; + } if (avio_read(pb, sc->cenc.default_encrypted_sample->key_id, 16) != 16) { - av_log(c->fc, AV_LOG_ERROR, "failed to read the default key ID"); + av_log(c->fc, AV_LOG_ERROR, "failed to read the default key ID\n"); return AVERROR_INVALIDDATA; } @@ -6286,7 +6291,7 @@ static int mov_read_tenc(MOVContext *c, AVIOContext *pb, MOVAtom atom) } if (avio_read(pb, sc->cenc.default_encrypted_sample->iv, iv_size) != iv_size) { - av_log(c->fc, AV_LOG_ERROR, "failed to read the default IV"); + av_log(c->fc, AV_LOG_ERROR, "failed to read the default IV\n"); return AVERROR_INVALIDDATA; } } -- cgit v1.2.3