mirror/nginx
1
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2024-12-04 13:59:00 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Mp4: fixed possible pointer overflow on 32-bit platforms.

Browse Source 
On 32-bit platforms mp4->buffer_pos might overflow when a large
enough (close to 4 gigabytes) atom is being skipped, resulting in
incorrect memory addesses being read further in the code.  In most
cases this results in harmless errors being logged, though may also
result in a segmentation fault if hitting unmapped pages.

To address this, ngx_mp4_atom_next() now only increments mp4->buffer_pos
up to mp4->buffer_end.  This ensures that overflow cannot happen.
This commit is contained in:
Maxim Dounin 2018-11-21 20:23:16 +03:00
parent 04618d00e0
commit 58b5516129
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/http/modules/ngx_http_mp4_module.c
View File

@ -169,7 +169,14 @@ typedef struct {
#define ngx_mp4_atom_next(mp4, n) \ #define ngx_mp4_atom_next(mp4, n) \
mp4->buffer_pos += (size_t) n; \ \
if (n > (size_t) (mp4->buffer_end - mp4->buffer_pos)) { \
mp4->buffer_pos = mp4->buffer_end; \
\
} else { \
mp4->buffer_pos += (size_t) n; \
} \
\
mp4->offset += n mp4->offset += n