mp4: fix potential integer overflow bug in the mp4_decode() function

A crafted mp4 file could cause an integer overflow in mp4_decode function in src/inputPlugins/mp4_plugin.c. mp4ff_num_samples() function returns some tainted value. sizeof(float) * numSamples is an integer overflow operation if numSamples is too huge, so xmalloc will allocate a small memory region. I constructe a mp4 file, and use faad2 to open the file. mp4ff_num_samples() returns -1. So I think mpd bears from the same problem.

mp4: fix potential integer overflow bug in the mp4_decode() function
79a14c9a · Terry · Max Kellermann · 89c8b19a · 79a14c9a
Commit 79a14c9a authored Sep 12, 2008 by Terry Committed by Max Kellermann Sep 12, 2008
Hide whitespace changes
Inline Side-by-side

Showing with 7 additions and 0 deletions

mp4_plugin.c src/inputPlugins/mp4_plugin.c +7 -0

No files found.
--- a/src/inputPlugins/mp4_plugin.c
+++ b/src/inputPlugins/mp4_plugin.c
@@ -174,6 +174,13 @@ static int mp4_decode(struct decoder * mpd_decoder, InputStream * inStream)
 	total_time = ((float)file_time) / scale;

 	numSamples = mp4ff_num_samples(mp4fh, track);
+	if (numSamples > (long)(INT_MAX / sizeof(float))) {
+		 ERROR("Integer overflow.\n");
+		 faacDecClose(decoder);
+		 mp4ff_close(mp4fh);
+		 free(mp4cb);
+		 return -1;
+	}

 	file_time = 0.0;