Boundary checks in Ap4ContainerAtom

The lack of boundary checks in Ap4ContainerAtom leads to an underflow in size which then leads to existing validation checks to fail and hence allow large malloc.
axiomatic-systems · Mar 28, 2024 · b977973 · b977973
1 parent 8806fe2
commit b977973
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/Source/C++/Core/Ap4ContainerAtom.cpp b/Source/C++/Core/Ap4ContainerAtom.cpp
@@ -136,6 +136,7 @@ AP4_ContainerAtom::AP4_ContainerAtom(Type             type,
                                      AP4_AtomFactory& atom_factory) :
     AP4_Atom(type, size, force_64)
 {
+    if (size < GetHeaderSize()) return;
     ReadChildren(atom_factory, stream, size-GetHeaderSize());
 }
 
@@ -151,6 +152,7 @@ AP4_ContainerAtom::AP4_ContainerAtom(Type             type,
                                      AP4_AtomFactory& atom_factory) :
     AP4_Atom(type, size, force_64, version, flags)
 {
+    if (size < GetHeaderSize()) return;
     ReadChildren(atom_factory, stream, size-GetHeaderSize());
 }