diff options
| author | Martin Storsjö <martin@martin.st> | 2013-09-28 23:57:36 +0300 |
|---|---|---|
| committer | Luca Barbato <lu_zero@gentoo.org> | 2014-01-07 09:43:57 +0100 |
| commit | 1438181a2943be1aa37ec955cae4905514cf317c (patch) | |
| tree | 0e8b1c488285d111c9a9526524762dead8f3db7c | |
| parent | 213b8aa0a90585f13aebb7fba39cbd3e367e98a6 (diff) | |
| download | ffmpeg-1438181a2943be1aa37ec955cae4905514cf317c.tar.gz | |
mov: Make sure the read sample count is nonnegative
This avoids setting a negative number of frames, ending up with a
negative average frame rate.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit c231987662194d009dd91bfc57c678e0e70ca161)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit c10f3fed259c23e6887f68cdf3e7d4ae87026f65)
| -rw-r--r-- | libavformat/mov.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavformat/mov.c b/libavformat/mov.c index 9cac5069c0..2096988ce7 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -1642,6 +1642,10 @@ static int mov_read_stts(MOVContext *c, AVIOContext *pb, MOVAtom atom) sample_count=avio_rb32(pb); sample_duration = avio_rb32(pb); + if (sample_count < 0) { + av_log(c->fc, AV_LOG_ERROR, "Invalid sample_count=%d\n", sample_count); + return AVERROR_INVALIDDATA; + } sc->stts_data[i].count= sample_count; sc->stts_data[i].duration= sample_duration; |