abema / go-mp4

Go library for reading and writing MP4 file
https://dev.to/sunfishshogi/go-mp4-golang-library-and-cli-tool-for-mp4-52o1
MIT License
464 stars 30 forks source link

Prevent RAM exhaustion by limiting maximum value of some fields #146

Closed aler9 closed 1 year ago

aler9 commented 1 year ago

@sunfish-shogi

Currently it's possible to exhaust available memory by inserting very large numbers into various size fields. This PR adds additional checks on a couple of size fields:

Both are now limited to 100KB. I'm not aware of any MP4 field whose content can exceed 100KB (excluding the content of mdat, which is not unmarshaled).

aler9 commented 1 year ago

This needs to be rethinked since mdat data is unmarshaled into a field.

sunfish-shogi commented 1 year ago

I created an issue: https://github.com/abema/go-mp4/issues/149 . I'm considering to add default maximum array length and the way to define individual limits for each box types (ex. mdat).

sunfish-shogi commented 1 year ago

@aler9 I created #150 I think this change prevents to allocate large memory which significantly exceeds file size.