Merge remote-tracking branch 'origin/master'

deepch · Jan 8, 2024 · 06a7f70 · 06a7f70
2 parents 975d994 + eaab841
commit 06a7f70
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/format/mp4/mp4io/mp4io.go b/format/mp4/mp4io/mp4io.go
@@ -387,6 +387,10 @@ func ReadFileAtoms(r io.ReadSeeker) (atoms []Atom, err error) {
 			return
 		}
 		size := pio.U32BE(taghdr[0:])
+		if size > 5242880 {
+			err = parseErr("len", 5242880, err)
+			return 
+		}
 		tag := Tag(pio.U32BE(taghdr[4:]))
 
 		var atom Atom