diff options
| author | Marton Balint <cus@passwd.hu> | 2019-04-04 23:08:42 +0200 |
|---|---|---|
| committer | Marton Balint <cus@passwd.hu> | 2019-04-28 21:55:28 +0200 |
| commit | 3dee6c09970dd0defad91e8270f66a4be3b6570d (patch) | |
| tree | ba0d68ef8176a95cb038245e7e7c153e9b5c509a /libavformat/mxfdec.c | |
| parent | fc15e8306f84396fa26798587552500ff2746ada (diff) | |
| download | ffmpeg-3dee6c09970dd0defad91e8270f66a4be3b6570d.tar.gz | |
avformat/mxfdec: fix and enhance RIP KLV length checks
KLV length is BER encoded (variable size), but the code assumed the encoding to
always use 4 bytes.
Fixes parsing Random Index Pack in samples/MXF/issue2160/PW0805A0V01.4C5B5636.EFA330.mxf.
Signed-off-by: Marton Balint <cus@passwd.hu>
Diffstat (limited to 'libavformat/mxfdec.c')
| -rw-r--r-- | libavformat/mxfdec.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c index 0f80d27534..bb72fb9841 100644 --- a/libavformat/mxfdec.c +++ b/libavformat/mxfdec.c @@ -3138,9 +3138,12 @@ static void mxf_read_random_index_pack(AVFormatContext *s) goto end; avio_seek(s->pb, file_size - length, SEEK_SET); if (klv_read_packet(&klv, s->pb) < 0 || - !IS_KLV_KEY(klv.key, mxf_random_index_pack_key) || - klv.length != length - 20) + !IS_KLV_KEY(klv.key, mxf_random_index_pack_key)) goto end; + if (klv.next_klv != file_size || klv.length <= 4 || (klv.length - 4) % 12) { + av_log(s, AV_LOG_WARNING, "Invalid RIP KLV length\n"); + goto end; + } avio_skip(s->pb, klv.length - 12); mxf->footer_partition = avio_rb64(s->pb); |