]> git.nihav.org Git - nihav.git/commitdiff
avi: reject chunks larger than remaining movi size master
authorKostya Shishkov <kostya.shishkov@gmail.com>
Sat, 14 Feb 2026 17:33:13 +0000 (18:33 +0100)
committerKostya Shishkov <kostya.shishkov@gmail.com>
Sat, 14 Feb 2026 17:33:13 +0000 (18:33 +0100)
nihav-commonfmt/src/demuxers/avi.rs

index 44d68f8376585a6fcccaf398a103ee50bed51f6c..40290abe7ca5bc28edd8c1252c1845d4443d2cd2 100644 (file)
@@ -609,6 +609,10 @@ impl<'a> DemuxCore<'a> for AVIDemuxer<'a> {
             let is_keyframe = self.state.key_offs.binary_search(&self.src.tell()).is_ok();
             let tag = self.src.read_tag()?;
             let size = self.src.read_u32le()? as usize;
+            if size > self.state.movi_size {
+                self.state.movi_size = 0;
+                return Err(InvalidData);
+            }
             match &tag {
                 b"JUNK" => {
                     self.state.movi_size -= size + 8;