isomp4: validate es descriptor length

pdeljanov · Jan 19, 2025 · bb528d9 · bb528d9
1 parent fcfb07a
commit bb528d9
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/symphonia-format-isomp4/src/atoms/esds.rs b/symphonia-format-isomp4/src/atoms/esds.rs
@@ -243,6 +243,8 @@ pub struct ESDescriptor {
 
 impl ObjectDescriptor for ESDescriptor {
     fn read<B: ReadBytes>(reader: &mut B, len: u32) -> Result<Self> {
+        let pos = reader.pos();
+
         let es_id = reader.read_be_u16()?;
         let es_flags = reader.read_u8()?;
 
@@ -265,6 +267,11 @@ impl ObjectDescriptor for ESDescriptor {
         let mut dec_config = None;
         let mut sl_config = None;
 
+        // len should be bigger than what have been read
+        if reader.pos() - pos > len as u64 {
+            return decode_error("isomp4: es descriptor len is wrong");
+        }
+
         let mut scoped = ScopedStream::new(reader, u64::from(len) - 3);
 
         // Multiple descriptors follow, but only the decoder configuration descriptor is useful.