• Sebastian Dröge's avatar
    h2645parser: Catch overflows in AVC/HEVC NAL unit length calculations · ffa4d84e
    Sebastian Dröge authored and Sebastian Dröge's avatar Sebastian Dröge committed
    Offset and size are stored as 32 bit guint and might overflow when
    adding the nal_length_size, so let's avoid that.
    For the size this would happen if the AVC/HEVC NAL unit size happens to
    be stored in 4 bytes and is 4294967292 or higher, which is likely
    corrupted data anyway.
    For the offset this is something for the caller of these functions to
    take care of but is unlikely to happen as it would require parsing on a
    >4GB buffer.
    Allowing these overflows causes all kinds of follow-up bugs in the
    h2645parse elements, ranging from infinite loops and memory leaks to
    potential memory corruptions.
    Part-of: <!2103>