blob: 742893b0d8854b9965c54dd68330635e235c3faf (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
|
#ffmpeg: don't use EBML elements in Matroska that are bigger than their parents.
#https://hackerone.com/reports/492882
--- ffmpeg/libavformat/matroskadec.c.overshoot 2019-02-11 16:03:57.375444600 +0100
+++ ffmpeg/libavformat/matroskadec.c 2019-02-11 16:04:04.418307200 +0100
@@ -1197,6 +1197,18 @@ static int ebml_parse_elem(MatroskaDemux
length, max_lengths[syntax->type], syntax->type);
return AVERROR_INVALIDDATA;
}
+ if (matroska->num_levels > 0) {
+ MatroskaLevel *level = &matroska->levels[matroska->num_levels - 1];
+ AVIOContext *pb = matroska->ctx->pb;
+ int64_t pos = avio_tell(pb);
+ if (level->length != (uint64_t) -1 &&
+ (pos + length) > (level->start + level->length)) {
+ av_log(matroska->ctx, AV_LOG_ERROR,
+ "Invalid length 0x%"PRIx64" > 0x%"PRIx64" in parent\n",
+ length, level->start + level->length);
+ return AVERROR_INVALIDDATA;
+ }
+ }
}
switch (syntax->type) {
|
