diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2018-05-21 03:16:58 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2018-07-10 01:52:56 +0200 |
| commit | 17ed3c809da5852c3d5c41df14f0d44a8d7c10a9 (patch) | |
| tree | 8e39efe33780e09023d487f0eb5f750bc3845e2b | |
| parent | 674929cd46c76285f4d739c0436a75a5402dee61 (diff) | |
| download | ffmpeg-17ed3c809da5852c3d5c41df14f0d44a8d7c10a9.tar.gz | |
avformat/mov: replace a value error by clipping into valid range in mov_read_stsc()
Fixes: #7165
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fe84f70819d6f5aab3c4823290e0d32b99d6de78)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/mov.c | 14 |
1 files changed, 11 insertions, 3 deletions
diff --git a/libavformat/mov.c b/libavformat/mov.c index c85d3a6eda..4f1662fc30 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -2229,14 +2229,22 @@ static int mov_read_stsc(MOVContext *c, AVIOContext *pb, MOVAtom atom) sc->stsc_count = i; for (i = sc->stsc_count - 1; i < UINT_MAX; i--) { + int64_t first_min = i + 1; if ((i+1 < sc->stsc_count && sc->stsc_data[i].first >= sc->stsc_data[i+1].first) || (i > 0 && sc->stsc_data[i].first <= sc->stsc_data[i-1].first) || - sc->stsc_data[i].first < 1 || + sc->stsc_data[i].first < first_min || sc->stsc_data[i].count < 1 || sc->stsc_data[i].id < 1) { av_log(c->fc, AV_LOG_WARNING, "STSC entry %d is invalid (first=%d count=%d id=%d)\n", i, sc->stsc_data[i].first, sc->stsc_data[i].count, sc->stsc_data[i].id); - if (i+1 >= sc->stsc_count || sc->stsc_data[i+1].first < 2) - return AVERROR_INVALIDDATA; + if (i+1 >= sc->stsc_count) { + sc->stsc_data[i].first = FFMAX(sc->stsc_data[i].first, first_min); + if (i > 0 && sc->stsc_data[i].first <= sc->stsc_data[i-1].first) + sc->stsc_data[i].first = FFMIN(sc->stsc_data[i-1].first + 1LL, INT_MAX); + sc->stsc_data[i].count = FFMAX(sc->stsc_data[i].count, 1); + sc->stsc_data[i].id = FFMAX(sc->stsc_data[i].id, 1); + continue; + } + av_assert0(sc->stsc_data[i+1].first >= 2); // We replace this entry by the next valid sc->stsc_data[i].first = sc->stsc_data[i+1].first - 1; sc->stsc_data[i].count = sc->stsc_data[i+1].count; |