Skip to content

Commit

Permalink
Add boundary checks to Ap4IproAtom
Browse files Browse the repository at this point in the history
Fuzzer caught another large malloc. This is caused by lack of boundary check
resulting in the next atom (children atom) to artificially large "size"
due to the underflow in bytes_available.
  • Loading branch information
roticv committed Mar 20, 2024
1 parent 147f15a commit 3ed084f
Showing 1 changed file with 4 additions and 0 deletions.
4 changes: 4 additions & 0 deletions Source/C++/Core/Ap4IproAtom.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -62,6 +62,10 @@ AP4_IproAtom::AP4_IproAtom(AP4_UI32 size,
AP4_AtomFactory& atom_factory) :
AP4_ContainerAtom(AP4_ATOM_TYPE_IPRO, size, false, version, flags)
{
if (size < AP4_FULL_ATOM_HEADER_SIZE + 2) {
return;
}

// read the number of entries
AP4_UI16 entry_count;
stream.ReadUI16(entry_count);
Expand Down

0 comments on commit 3ed084f

Please sign in to comment.