Mirrors/lofty-rs
2
0
Fork 0
mirror of https://github.com/Serial-ATA/lofty-rs synced 2024-11-10 06:34:18 +00:00
Code Issues Projects Releases Packages Wiki Activity

MP4: Fix panic on large stts entry counts

Browse source
This commit is contained in:
Serial 2024-07-28 13:51:43 -04:00 committed by Alex
parent dfb5601b7f
commit 51e9f5d8b9
3 changed files with 10 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
lofty/src/mp4/properties.rs
View file

@ -4,6 +4,7 @@ use crate::config::ParsingMode;
use crate::error::{LoftyError, Result};
use crate::macros::{decode_err, err, try_vec};
use crate::properties::FileProperties;
use crate::util::alloc::VecFallibleCapacity;
use crate::util::math::RoundedDivision;
use std::io::{Cursor, Read, Seek, SeekFrom};
@ -340,7 +341,7 @@ where
let _version_and_flags = reader.read_uint::<BigEndian>(4)?;
let entry_count = reader.read_u32::<BigEndian>()?;
let mut entries = Vec::with_capacity(entry_count as usize);
let mut entries = Vec::try_with_capacity_stable(entry_count as usize)?;
for _ in 0..entry_count {
let sample_count = reader.read_u32::<BigEndian>()?;

BIN
lofty/tests/fuzz/assets/mp4file_read_from/ui_steam_smoother_friend_join_IDX_53_RAND_83672409887817275057956.m4a Executable file
View file

Binary file not shown.

8
lofty/tests/fuzz/mp4file_read_from.rs
View file

@ -47,3 +47,11 @@ fn panic5() {
);
let _ = Mp4File::read_from(&mut reader, ParseOptions::new());
}
#[test]
fn panic6() {
let mut reader = crate::get_reader(
"mp4file_read_from/ui_steam_smoother_friend_join_IDX_53_RAND_83672409887817275057956.m4a",
);
let _ = Mp4File::read_from(&mut reader, ParseOptions::new());
}