[PR] avformat/mov: bound the iref thmb/cdsc entry count by the sub-box size (PR #23667)

PR #23667 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23667
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23667.patch

Fixes: excessive parsing past the iref sub-box
Fixes: TMwMAJfgy3l9
Fixes: 74e430202d933284fc38b591d4b3a12464e8aec6 (avformat/mov: make items referencing items generic)
Found-by: Omkhar Arasaratnam
Signed-off-by: Michael Niedermayer <[email protected]>



>From be0f21067eba05b1565040eb751f6cc89092f504 Mon Sep 17 00:00:00 2001
From: Omkhar Arasaratnam <[email protected]>
Date: Tue, 30 Jun 2026 21:58:38 +0200
Subject: [PATCH] avformat/mov: bound the iref thmb/cdsc entry count by the
 sub-box size

Fixes: excessive parsing past the iref sub-box
Fixes: TMwMAJfgy3l9
Fixes: 74e430202d933284fc38b591d4b3a12464e8aec6 (avformat/mov: make items referencing items generic)
Found-by: Omkhar Arasaratnam
Signed-off-by: Michael Niedermayer <[email protected]>
---
 libavformat/mov.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 90b01f9499..9340fc6240 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -9444,10 +9444,11 @@ fail:
     return ret;
 }
 
-static int mov_read_iref_cdsc(MOVContext *c, AVIOContext *pb, uint32_t type, int version)
+static int mov_read_iref_cdsc(MOVContext *c, AVIOContext *pb, uint32_t type, int version, uint32_t size)
 {
     HEIFItem *from_item = NULL;
     int entries;
+    int item_id_size = version ? 4 : 2;
     int from_item_id = version ? avio_rb32(pb) : avio_rb16(pb);
     const HEIFItemRef ref = { type, from_item_id };
 
@@ -9458,6 +9459,11 @@ static int mov_read_iref_cdsc(MOVContext *c, AVIOContext *pb, uint32_t type, int
     }
 
     entries = avio_rb16(pb);
+    if ((int64_t)entries * item_id_size > (int64_t)size - 8 - item_id_size - 2) {
+        av_log(c->fc, AV_LOG_ERROR, "iref %s entry count %d exceeds the sub-box size\n",
+               av_fourcc2str(type), entries);
+        return AVERROR_INVALIDDATA;
+    }
     /* 'to' item ids */
     for (int i = 0; i < entries; i++) {
         HEIFItem *item = get_heif_item(c, version ? avio_rb32(pb) : avio_rb16(pb));
@@ -9512,7 +9518,7 @@ static int mov_read_iref(MOVContext *c, AVIOContext *pb, MOVAtom atom)
             break;
         case MKTAG('c','d','s','c'):
         case MKTAG('t','h','m','b'):
-            ret = mov_read_iref_cdsc(c, pb, type, version);
+            ret = mov_read_iref_cdsc(c, pb, type, version, size);
             if (ret < 0)
                 return ret;
             break;
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]