diff options
| author | Alex Converse <alex.converse@gmail.com> | 2012-03-21 11:24:10 -0700 |
|---|---|---|
| committer | Alex Converse <alex.converse@gmail.com> | 2012-03-22 13:57:12 -0700 |
| commit | 86f2ae06b92d42580ae7ebd86d52c9b7acbc2f13 (patch) | |
| tree | b8215e23ada3b4aafd7ea1efa8a78ee121f23b77 /libavformat/mov.c | |
| parent | 3e6e89b3d61876b49f4c5d17a36d40e96ccf7ce4 (diff) | |
| download | ffmpeg-86f2ae06b92d42580ae7ebd86d52c9b7acbc2f13.tar.gz | |
mov: Do not read past the end of the ctts_data table.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Diffstat (limited to 'libavformat/mov.c')
| -rw-r--r-- | libavformat/mov.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavformat/mov.c b/libavformat/mov.c index 7b21423afa..75dec37872 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -2713,7 +2713,7 @@ static int mov_read_packet(AVFormatContext *s, AVPacket *pkt) pkt->stream_index = sc->ffindex; pkt->dts = sample->timestamp; - if (sc->ctts_data) { + if (sc->ctts_data && sc->ctts_index < sc->ctts_count) { pkt->pts = pkt->dts + sc->dts_shift + sc->ctts_data[sc->ctts_index].duration; /* update ctts context */ sc->ctts_sample++; |