Skip to content

mp4v2 security fixes #76

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
KMojek merged 3 commits into from
Sep 13, 2024
Merged

mp4v2 security fixes #76

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f756267
Fix a potential crash
KMojek Sep 13, 2024
d825f55
Fix a potential crash
KMojek Sep 13, 2024
01a8cd2
Fix a potential crash
KMojek Sep 13, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions src/atom_ftyp.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,9 @@ void MP4FtypAtom::Generate()

void MP4FtypAtom::Read()
{
if ( m_size == 0ULL )
return;

compatibleBrands.SetCount( (m_size - 8) / 4 ); // brands array fills rest of atom
MP4Atom::Read();
}
Expand Down
6 changes: 3 additions & 3 deletions src/atoms.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -491,9 +491,9 @@ class MP4SdtpAtom : public MP4FullAtom {
// number of bytes == stsz.sampleCount.
MP4BytesProperty& data;
private:
MP4SdtpAtom();
MP4SdtpAtom( const MP4SdtpAtom &src );
MP4SdtpAtom &operator= ( const MP4SdtpAtom &src );
MP4SdtpAtom() = delete;
MP4SdtpAtom( const MP4SdtpAtom& src ) = delete;
MP4SdtpAtom& operator=( const MP4SdtpAtom& src ) = delete;
};

class MP4SmiAtom : public MP4Atom {
Expand Down
10 changes: 9 additions & 1 deletion src/mp4atom.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -395,7 +395,15 @@ void MP4Atom::ReadProperties(uint32_t startIndex, uint32_t count)
m_File.GetPosition(), m_end);

ostringstream oss;
oss << "atom '" << GetType() << "' is too small; overrun at property: " << m_pProperties[i]->GetName();
const char* propName = nullptr;
auto prop = m_pProperties[i];
if ( prop != nullptr )
propName = prop->GetName();
if ( propName != nullptr )
oss << "atom '" << GetType() << "' is too small; overrun at property: " << propName;
else
oss << "atom '" << GetType() << "' is too small; overrun reading property";

throw new Exception( oss.str().c_str(), __FILE__, __LINE__, __FUNCTION__ );
}

Expand Down
16 changes: 9 additions & 7 deletions src/mp4track.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -237,13 +237,15 @@ MP4Track::MP4Track(MP4File& file, MP4Atom& trakAtom)
CalculateBytesPerSample();

// update sdtp log from sdtp atom
MP4SdtpAtom* sdtp = (MP4SdtpAtom*)m_trakAtom.FindAtom( "trak.mdia.minf.stbl.sdtp" );
if( sdtp ) {
uint8_t* buffer;
uint32_t bufsize;
sdtp->data.GetValue( &buffer, &bufsize );
m_sdtpLog.assign( (char*)buffer, bufsize );
free( buffer );
MP4Atom* atom = m_trakAtom.FindAtom( "trak.mdia.minf.stbl.sdtp" );
MP4SdtpAtom* sdtp = dynamic_cast<MP4SdtpAtom *>( atom );
if ( sdtp != nullptr )
{
uint8_t* buffer;
uint32_t bufsize;
sdtp->data.GetValue( &buffer, &bufsize );
m_sdtpLog.assign( (char*)buffer, bufsize );
free( buffer );
}
}

Expand Down