forked from rpms/nginx
85 lines
4.1 KiB
Diff
85 lines
4.1 KiB
Diff
From 3568812cf98dfd7661cd7516ecf9b398c134ab3c Mon Sep 17 00:00:00 2001
|
|
From: Roman Arutyunyan <arut@nginx.com>
|
|
Date: Mon, 2 Mar 2026 21:12:34 +0400
|
|
Subject: [PATCH] Mp4: fixed possible integer overflow on 32-bit platforms.
|
|
|
|
Previously, a 32-bit overflow could happen while validating atom entries
|
|
count. This allowed processing of an invalid atom with entrires beyond
|
|
its boundaries with reads and writes outside of the allocated mp4 buffer.
|
|
|
|
Reported by Prabhav Srinath (sprabhav7).
|
|
---
|
|
src/http/modules/ngx_http_mp4_module.c | 14 +++++++-------
|
|
1 file changed, 7 insertions(+), 7 deletions(-)
|
|
|
|
diff --git a/src/http/modules/ngx_http_mp4_module.c b/src/http/modules/ngx_http_mp4_module.c
|
|
index 173d8ad54..678d6296c 100644
|
|
--- a/src/http/modules/ngx_http_mp4_module.c
|
|
+++ b/src/http/modules/ngx_http_mp4_module.c
|
|
@@ -2297,7 +2297,7 @@ ngx_http_mp4_read_stts_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
|
|
"mp4 time-to-sample entries:%uD", entries);
|
|
|
|
if (ngx_mp4_atom_data_size(ngx_mp4_stts_atom_t)
|
|
- + entries * sizeof(ngx_mp4_stts_entry_t) > atom_data_size)
|
|
+ + (uint64_t) entries * sizeof(ngx_mp4_stts_entry_t) > atom_data_size)
|
|
{
|
|
ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
|
|
"\"%s\" mp4 stts atom too small", mp4->file.name.data);
|
|
@@ -2612,7 +2612,7 @@ ngx_http_mp4_read_stss_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
|
|
atom->last = atom_table;
|
|
|
|
if (ngx_mp4_atom_data_size(ngx_http_mp4_stss_atom_t)
|
|
- + entries * sizeof(uint32_t) > atom_data_size)
|
|
+ + (uint64_t) entries * sizeof(uint32_t) > atom_data_size)
|
|
{
|
|
ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
|
|
"\"%s\" mp4 stss atom too small", mp4->file.name.data);
|
|
@@ -2817,7 +2817,7 @@ ngx_http_mp4_read_ctts_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
|
|
atom->last = atom_table;
|
|
|
|
if (ngx_mp4_atom_data_size(ngx_mp4_ctts_atom_t)
|
|
- + entries * sizeof(ngx_mp4_ctts_entry_t) > atom_data_size)
|
|
+ + (uint64_t) entries * sizeof(ngx_mp4_ctts_entry_t) > atom_data_size)
|
|
{
|
|
ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
|
|
"\"%s\" mp4 ctts atom too small", mp4->file.name.data);
|
|
@@ -2999,7 +2999,7 @@ ngx_http_mp4_read_stsc_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
|
|
"sample-to-chunk entries:%uD", entries);
|
|
|
|
if (ngx_mp4_atom_data_size(ngx_mp4_stsc_atom_t)
|
|
- + entries * sizeof(ngx_mp4_stsc_entry_t) > atom_data_size)
|
|
+ + (uint64_t) entries * sizeof(ngx_mp4_stsc_entry_t) > atom_data_size)
|
|
{
|
|
ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
|
|
"\"%s\" mp4 stsc atom too small", mp4->file.name.data);
|
|
@@ -3393,7 +3393,7 @@ ngx_http_mp4_read_stsz_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
|
|
|
|
if (size == 0) {
|
|
if (ngx_mp4_atom_data_size(ngx_mp4_stsz_atom_t)
|
|
- + entries * sizeof(uint32_t) > atom_data_size)
|
|
+ + (uint64_t) entries * sizeof(uint32_t) > atom_data_size)
|
|
{
|
|
ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
|
|
"\"%s\" mp4 stsz atom too small",
|
|
@@ -3552,7 +3552,7 @@ ngx_http_mp4_read_stco_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
|
|
ngx_log_debug1(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0, "chunks:%uD", entries);
|
|
|
|
if (ngx_mp4_atom_data_size(ngx_mp4_stco_atom_t)
|
|
- + entries * sizeof(uint32_t) > atom_data_size)
|
|
+ + (uint64_t) entries * sizeof(uint32_t) > atom_data_size)
|
|
{
|
|
ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
|
|
"\"%s\" mp4 stco atom too small", mp4->file.name.data);
|
|
@@ -3768,7 +3768,7 @@ ngx_http_mp4_read_co64_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
|
|
ngx_log_debug1(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0, "chunks:%uD", entries);
|
|
|
|
if (ngx_mp4_atom_data_size(ngx_mp4_co64_atom_t)
|
|
- + entries * sizeof(uint64_t) > atom_data_size)
|
|
+ + (uint64_t) entries * sizeof(uint64_t) > atom_data_size)
|
|
{
|
|
ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
|
|
"\"%s\" mp4 co64 atom too small", mp4->file.name.data);
|
|
--
|
|
2.53.0
|
|
|