diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2011-12-15 20:51:00 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-01-03 18:25:27 +0100 |
| commit | 17044e1a2bb1926a4937974b58e25061f03739a0 (patch) | |
| tree | 05d9a0f26698442b790ae5529ee4575ede5546d3 | |
| parent | 19babec06f54a9696e85964a84c01c1602ebcecc (diff) | |
| download | ffmpeg-17044e1a2bb1926a4937974b58e25061f03739a0.tar.gz | |
mov: Fix near infinite loop in stsd parsing.
Fixes Ticket768
Bug found by: Diana Elena Muscalu
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 5f95c130a020ec8f6eb7ade8808f59dac5834410)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavformat/mov.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/libavformat/mov.c b/libavformat/mov.c index 12af19ed50..54fd3dfa22 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -1082,6 +1082,9 @@ int ff_mov_read_stsd_entries(MOVContext *c, AVIOContext *pb, int entries) avio_rb32(pb); /* reserved */ avio_rb16(pb); /* reserved */ dref_id = avio_rb16(pb); + }else if (size <= 0){ + av_log(c->fc, AV_LOG_ERROR, "invalid size %d in stsd\n", size); + return -1; } if (st->codec->codec_tag && |