Skip to content

Commit

Permalink
MP4: Fix panic on large stts entry counts
Browse files Browse the repository at this point in the history
  • Loading branch information
Serial-ATA committed Jul 28, 2024
1 parent 84f122c commit d034698
Show file tree
Hide file tree
Showing 3 changed files with 10 additions and 1 deletion.
3 changes: 2 additions & 1 deletion lofty/src/mp4/properties.rs
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@ use crate::config::ParsingMode;
use crate::error::{LoftyError, Result};
use crate::macros::{decode_err, err, try_vec};
use crate::properties::FileProperties;
use crate::util::alloc::VecFallibleCapacity;
use crate::util::math::RoundedDivision;

use std::io::{Cursor, Read, Seek, SeekFrom};
Expand Down Expand Up @@ -340,7 +341,7 @@ where
let _version_and_flags = reader.read_uint::<BigEndian>(4)?;

let entry_count = reader.read_u32::<BigEndian>()?;
let mut entries = Vec::with_capacity(entry_count as usize);
let mut entries = Vec::try_with_capacity_stable(entry_count as usize)?;

for _ in 0..entry_count {
let sample_count = reader.read_u32::<BigEndian>()?;
Expand Down
Binary file not shown.
8 changes: 8 additions & 0 deletions lofty/tests/fuzz/mp4file_read_from.rs
Original file line number Diff line number Diff line change
Expand Up @@ -47,3 +47,11 @@ fn panic5() {
);
let _ = Mp4File::read_from(&mut reader, ParseOptions::new());
}

#[test]
fn panic6() {
let mut reader = crate::get_reader(
"mp4file_read_from/ui_steam_smoother_friend_join_IDX_53_RAND_83672409887817275057956.m4a",
);
let _ = Mp4File::read_from(&mut reader, ParseOptions::new());
}

0 comments on commit d034698

Please sign in to comment.