diff options
author | Michael Niedermayer <michael@niedermayer.cc> | 2018-05-21 03:16:58 +0200 |
---|---|---|
committer | Michael Niedermayer <michael@niedermayer.cc> | 2018-05-22 21:05:45 +0200 |
commit | fe84f70819d6f5aab3c4823290e0d32b99d6de78 (patch) | |
tree | 68bd4e6fcf48cc0778ca63b37891e14ce5cb4462 /libavformat/mov.c | |
parent | 919e37377a76f63d030d680fcb9506a3f8cc2d62 (diff) | |
download | ffmpeg-fe84f70819d6f5aab3c4823290e0d32b99d6de78.tar.gz |
avformat/mov: replace a value error by clipping into valid range in mov_read_stsc()
Fixes: #7165
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavformat/mov.c')
-rw-r--r-- | libavformat/mov.c | 14 |
1 files changed, 11 insertions, 3 deletions
diff --git a/libavformat/mov.c b/libavformat/mov.c index a078bf4712..f2a540ad50 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -2642,14 +2642,22 @@ static int mov_read_stsc(MOVContext *c, AVIOContext *pb, MOVAtom atom) sc->stsc_count = i; for (i = sc->stsc_count - 1; i < UINT_MAX; i--) { + int64_t first_min = i + 1; if ((i+1 < sc->stsc_count && sc->stsc_data[i].first >= sc->stsc_data[i+1].first) || (i > 0 && sc->stsc_data[i].first <= sc->stsc_data[i-1].first) || - sc->stsc_data[i].first < 1 || + sc->stsc_data[i].first < first_min || sc->stsc_data[i].count < 1 || sc->stsc_data[i].id < 1) { av_log(c->fc, AV_LOG_WARNING, "STSC entry %d is invalid (first=%d count=%d id=%d)\n", i, sc->stsc_data[i].first, sc->stsc_data[i].count, sc->stsc_data[i].id); - if (i+1 >= sc->stsc_count || sc->stsc_data[i+1].first < 2) - return AVERROR_INVALIDDATA; + if (i+1 >= sc->stsc_count) { + sc->stsc_data[i].first = FFMAX(sc->stsc_data[i].first, first_min); + if (i > 0 && sc->stsc_data[i].first <= sc->stsc_data[i-1].first) + sc->stsc_data[i].first = FFMIN(sc->stsc_data[i-1].first + 1LL, INT_MAX); + sc->stsc_data[i].count = FFMAX(sc->stsc_data[i].count, 1); + sc->stsc_data[i].id = FFMAX(sc->stsc_data[i].id, 1); + continue; + } + av_assert0(sc->stsc_data[i+1].first >= 2); // We replace this entry by the next valid sc->stsc_data[i].first = sc->stsc_data[i+1].first - 1; sc->stsc_data[i].count = sc->stsc_data[i+1].count; |