aboutsummaryrefslogtreecommitdiffstats
path: root/libavcodec
diff options
context:
space:
mode:
authorSasi Inguva <isasi-at-google.com@ffmpeg.org>2016-09-27 19:23:20 -0700
committerMichael Niedermayer <michael@niedermayer.cc>2016-09-28 17:11:52 +0200
commit82b58841c9d0e9d7d76d59438fe6b2a315e07e38 (patch)
tree06bf25fe3f32f0c690f92bf2cd517aa9a68b2863 /libavcodec
parente5bf7ab3e7c6432da47958105ac59ee2681d3198 (diff)
downloadffmpeg-82b58841c9d0e9d7d76d59438fe6b2a315e07e38.tar.gz
lavc/movtextdec.c: Avoid infinite loop on invalid data.
Signed-off-by: Sasi Inguva <isasi@google.com> (cherry picked from commit 7e9e1b7070242a79fa6e3acd749d7fe76e39ea7b) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec')
-rw-r--r--libavcodec/movtextdec.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/movtextdec.c b/libavcodec/movtextdec.c
index 8d0e8141d3..28f7b8f5be 100644
--- a/libavcodec/movtextdec.c
+++ b/libavcodec/movtextdec.c
@@ -477,6 +477,10 @@ static int mov_text_decode_frame(AVCodecContext *avctx,
tsmb_type = AV_RB32(tsmb);
tsmb += 4;
+ if (tsmb_size == 0) {
+ return AVERROR_INVALIDDATA;
+ }
+
if (tsmb_size == 1) {
if (m->tracksize + 16 > avpkt->size)
break;