tree 718cc6fd9a2c41ae0871337e2d4abfdc20b9ce25
parent 85519dc31dd0904b13af2e1f58854d5c8f1a1708
author Maxim Dounin <mdounin@mdounin.ru> 1542820996 +0300
committer Maxim Dounin <mdounin@mdounin.ru> 1542820996 +0300

Mp4: fixed possible pointer overflow on 32-bit platforms.

On 32-bit platforms mp4->buffer_pos might overflow when a large
enough (close to 4 gigabytes) atom is being skipped, resulting in
incorrect memory addesses being read further in the code.  In most
cases this results in harmless errors being logged, though may also
result in a segmentation fault if hitting unmapped pages.

To address this, ngx_mp4_atom_next() now only increments mp4->buffer_pos
up to mp4->buffer_end.  This ensures that overflow cannot happen.