Skip to content

Commit

Permalink
More boundary checks for Ap4SaioAtom
Browse files Browse the repository at this point in the history
Earlier boundary checks were insufficient to prevent certain potential
payloads. This adds more boundary checks to prevent underflow of remains. I have
also remove the usage of GetHeaderSize in constructor as it is a virtual method.
  • Loading branch information
roticv committed Mar 23, 2024
1 parent 06f0d06 commit 84b95d4
Showing 1 changed file with 3 additions and 1 deletion.
4 changes: 3 additions & 1 deletion Source/C++/Core/Ap4SaioAtom.cpp
Expand Up @@ -97,12 +97,14 @@ AP4_SaioAtom::AP4_SaioAtom(AP4_UI32 size,
m_AuxInfoType(0),
m_AuxInfoTypeParameter(0)
{
AP4_UI32 remains = size-GetHeaderSize();
AP4_SI32 remains = size-AP4_FULL_ATOM_HEADER_SIZE;
if (flags & 1) {
if (remains < 8) return;
stream.ReadUI32(m_AuxInfoType);
stream.ReadUI32(m_AuxInfoTypeParameter);
remains -= 8;
}
if (remains < 4) return;
AP4_UI32 entry_count = 0;
AP4_Result result = stream.ReadUI32(entry_count);
if (AP4_FAILED(result)) return;
Expand Down

0 comments on commit 84b95d4

Please sign in to comment.