commit b5c13002d18e8cd0ab19b37bb1fff3ea75ec3e5e
author Matt Wolenetz <wolenetz@google.com> Wed Feb 08 15:40:46 2017 -0800
committer Michael Niedermayer <michael@niedermayer.cc> Fri Feb 10 12:14:40 2017 +0100
tree e306e8975272cf153e3f6cb8aaff5ca28b42aa2d
parent a5dabd4013d1d4e90855d955fcc5069c6ddf8170

lavf/mov.c: Avoid OOB in mov_read_udta_string()

Core of patch is from paul@paulmehta.com
Reference https://crbug.com/643952 (udta_string portion)

Signed-off-by: Matt Wolenetz <wolenetz@chromium.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9bbdf5d921ef57e1698f64981e4ea04db7c56fb5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

libavformat/mov.c

diff --git a/libavformat/mov.c b/libavformat/mov.c
index b03a4b9..6fc792f 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -380,11 +380,11 @@
                 return ret;
             } else if (!key && c->found_hdlr_mdta && c->meta_keys) {
                 uint32_t index = AV_RB32(&atom.type);
-                if (index < c->meta_keys_count) {
+                if (index < c->meta_keys_count && index > 0) {
                     key = c->meta_keys[index];
                 } else {
                     av_log(c->fc, AV_LOG_WARNING,
-                           "The index of 'data' is out of range: %d >= %d.\n",
+                           "The index of 'data' is out of range: %d < 1 or >= %d.\n",
                            index, c->meta_keys_count);
                 }
             }