mirror/nginx
1
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2024-11-24 04:49:01 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Mp4: unordered stsc chunks error for the final chunk.

Browse Source 
Currently an error is triggered if any of the chunk runs in stsc are
unordered.  This however does not include the final chunk run, which
ends with trak->chunks + 1.  The previous chunk index can be larger
leading to a 32-bit overflow.  This could allow to skip the validity
check "if (start_sample > n)".  This could later lead to a large
trak->start_chunk/trak->end_chunk, which would be caught later in
ngx_http_mp4_update_stco_atom() or ngx_http_mp4_update_co64_atom().

While there are no implications of the validity check being avoided,
the change still adds a check to ensure the final chunk run is ordered,
to produce a meaningful error and avoid a potential integer overflow.
This commit is contained in:
Roman Arutyunyan 2024-10-02 16:22:15 +04:00 committed by Roman Arutyunyan
parent 6ec099a378
commit d1a02451c3
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/http/modules/ngx_http_mp4_module.c
View File

@ -3189,6 +3189,13 @@ ngx_http_mp4_crop_stsc_data(ngx_http_mp4_file_t *mp4,
next_chunk = trak->chunks + 1; next_chunk = trak->chunks + 1;
if (next_chunk < chunk) {
ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
"unordered mp4 stsc chunks in \"%s\"",
mp4->file.name.data);
return NGX_ERROR;
}
ngx_log_debug4(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0, ngx_log_debug4(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0,
"sample:%uD, chunk:%uD, chunks:%uD, samples:%uD", "sample:%uD, chunk:%uD, chunks:%uD, samples:%uD",
start_sample, chunk, next_chunk - chunk, samples); start_sample, chunk, next_chunk - chunk, samples);