diff options
| author | Alex Converse <[email protected]> | 2012-03-21 11:24:10 -0700 |
|---|---|---|
| committer | Reinhard Tartler <[email protected]> | 2012-04-29 22:07:02 +0200 |
| commit | 86bd0244ec01e873614d94e88177836a9ce650c1 (patch) | |
| tree | a68eef3c976f5e4b442a73acd0d5cf5b872f8541 | |
| parent | 15de658c04b6ce6a6628702837f98b8572e6b9f4 (diff) | |
mov: Do not read past the end of the ctts_data table.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: [email protected]
(cherry picked from commit 86f2ae06b92d42580ae7ebd86d52c9b7acbc2f13)
Signed-off-by: Reinhard Tartler <[email protected]>
| -rw-r--r-- | libavformat/mov.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavformat/mov.c b/libavformat/mov.c index 089cdea558..c5270695c1 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -2668,7 +2668,7 @@ static int mov_read_packet(AVFormatContext *s, AVPacket *pkt) pkt->stream_index = sc->ffindex; pkt->dts = sample->timestamp; - if (sc->ctts_data) { + if (sc->ctts_data && sc->ctts_index < sc->ctts_count) { pkt->pts = pkt->dts + sc->dts_shift + sc->ctts_data[sc->ctts_index].duration; /* update ctts context */ sc->ctts_sample++; |