diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2015-02-25 13:00:51 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2015-02-25 13:31:34 +0100 |
| commit | bbbc8c618884a838c00faaaa91898017dd431117 (patch) | |
| tree | 323d3222ec43df51473734b443e5399390f236cd | |
| parent | 1f5c7781e63d6519192ada59c1e36bcecc92791d (diff) | |
| download | ffmpeg-bbbc8c618884a838c00faaaa91898017dd431117.tar.gz | |
avformat/mov: Check ctts_count before use
Fixes out of array read
Fixes: asan_heap-oob_ae74b5_3610_cov_1739568095_test.3g2
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavformat/mov.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/libavformat/mov.c b/libavformat/mov.c index 3d68ac80a3..5ff753d5c8 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -4191,7 +4191,11 @@ static AVIndexEntry *mov_find_next_sample(AVFormatContext *s, AVStream **st) if (msc->pb && msc->current_sample < avst->nb_index_entries) { AVIndexEntry *current_sample = &avst->index_entries[msc->current_sample]; int64_t dts; - if (msc->ctts_data) + + if (msc->ctts_data && msc->ctts_index >= msc->ctts_count) + av_log(s, AV_LOG_WARNING, "CTTS list too small\n"); + + if (msc->ctts_data && msc->ctts_index < msc->ctts_count) dts = av_rescale(current_sample->timestamp - msc->dts_shift - msc->ctts_data[msc->ctts_index].duration, AV_TIME_BASE, msc->time_scale); else |