Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

More fixes for issues caught by fuzzer #935

Merged
merged 6 commits into from Apr 6, 2024
Merged

More fixes for issues caught by fuzzer #935

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
06f0d06
Add boundary checks to Ap4OdheAtom
roticv Mar 23, 2024
84b95d4
More boundary checks for Ap4SaioAtom
roticv Mar 23, 2024
f9f6b22
Add boundary checks to Ap4SbgpAtom
roticv Mar 24, 2024
8806fe2
Prevent overflow in boundary check for Ap4SbgpAtom
roticv Mar 27, 2024
b977973
Boundary checks in Ap4ContainerAtom
roticv Mar 28, 2024
26df396
Add boundary checks for Ap4StsdAtom
roticv Apr 2, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
2 changes: 2 additions & 0 deletions Source/C++/Core/Ap4ContainerAtom.cpp
View file
Open in desktop
Expand Up @@ -136,6 +136,7 @@ AP4_ContainerAtom::AP4_ContainerAtom(Type type,
AP4_AtomFactory& atom_factory) :
AP4_Atom(type, size, force_64)
{
if (size < GetHeaderSize()) return;
ReadChildren(atom_factory, stream, size-GetHeaderSize());
}

Expand All @@ -151,6 +152,7 @@ AP4_ContainerAtom::AP4_ContainerAtom(Type type,
AP4_AtomFactory& atom_factory) :
AP4_Atom(type, size, force_64, version, flags)
{
if (size < GetHeaderSize()) return;
ReadChildren(atom_factory, stream, size-GetHeaderSize());
}

Expand Down
2 changes: 2 additions & 0 deletions Source/C++/Core/Ap4OdheAtom.cpp
View file
Open in desktop
Expand Up @@ -64,9 +64,11 @@ AP4_OdheAtom::AP4_OdheAtom(AP4_UI32 size,
AP4_AtomFactory& atom_factory) :
AP4_ContainerAtom(AP4_ATOM_TYPE_ODHE, size, false, version, flags)
{
if (size < AP4_FULL_ATOM_HEADER_SIZE+1) return;
// read the content type
AP4_UI08 content_type_length;
stream.ReadUI08(content_type_length);
if (size < AP4_FULL_ATOM_HEADER_SIZE+1+content_type_length) return;
char content_type[256];
stream.Read(content_type, content_type_length);
m_ContentType.Assign(content_type, content_type_length);
Expand Down
4 changes: 3 additions & 1 deletion Source/C++/Core/Ap4SaioAtom.cpp
View file
Open in desktop
Expand Up @@ -97,12 +97,14 @@ AP4_SaioAtom::AP4_SaioAtom(AP4_UI32 size,
m_AuxInfoType(0),
m_AuxInfoTypeParameter(0)
{
AP4_UI32 remains = size-GetHeaderSize();
AP4_SI32 remains = size-AP4_FULL_ATOM_HEADER_SIZE;
if (flags & 1) {
if (remains < 8) return;
stream.ReadUI32(m_AuxInfoType);
stream.ReadUI32(m_AuxInfoTypeParameter);
remains -= 8;
}
if (remains < 4) return;
AP4_UI32 entry_count = 0;
AP4_Result result = stream.ReadUI32(entry_count);
if (AP4_FAILED(result)) return;
Expand Down
7 changes: 5 additions & 2 deletions Source/C++/Core/Ap4SbgpAtom.cpp
View file
Open in desktop
Expand Up @@ -73,18 +73,21 @@ AP4_SbgpAtom::AP4_SbgpAtom(AP4_UI32 size,
m_GroupingType(0),
m_GroupingTypeParameter(0)
{
AP4_UI32 remains = size-GetHeaderSize();
if (size < AP4_FULL_ATOM_HEADER_SIZE + 4) return;
AP4_UI32 remains = size-AP4_FULL_ATOM_HEADER_SIZE;
stream.ReadUI32(m_GroupingType);
remains -= 4;
if (version >= 1) {
if (remains < 4) return;
stream.ReadUI32(m_GroupingTypeParameter);
remains -= 4;
}
if (remains < 4) return;
AP4_UI32 entry_count = 0;
AP4_Result result = stream.ReadUI32(entry_count);
if (AP4_FAILED(result)) return;
remains -= 4;
if (remains < entry_count*8) {
if (remains < (AP4_UI64)entry_count*8) {
return;
}
m_Entries.SetItemCount(entry_count);
Expand Down
1 change: 1 addition & 0 deletions Source/C++/Core/Ap4StsdAtom.cpp
View file
Open in desktop
Expand Up @@ -87,6 +87,7 @@ AP4_StsdAtom::AP4_StsdAtom(AP4_UI32 size,
AP4_AtomFactory& atom_factory) :
AP4_ContainerAtom(AP4_ATOM_TYPE_STSD, size, false, version, flags)
{
if (size < AP4_FULL_ATOM_HEADER_SIZE + 4) return;
// read the number of entries
AP4_UI32 entry_count;
stream.ReadUI32(entry_count);
Expand Down