aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--libavformat/mov.c13
1 files changed, 10 insertions, 3 deletions
diff --git a/libavformat/mov.c b/libavformat/mov.c
index b4ff4ff513..fc57399b9b 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -226,8 +226,10 @@ static int mov_metadata_loci(MOVContext *c, AVIOContext *pb, unsigned len)
double longitude, latitude;
const char *key = "location";
- if (len < 4 + 2 + 1 + 1 + 4 + 4 + 4)
+ if (len < 4 + 2 + 1 + 1 + 4 + 4 + 4) {
+ av_log(c->fc, AV_LOG_ERROR, "loci too short\n");
return AVERROR_INVALIDDATA;
+ }
avio_skip(pb, 4); // version+flags
langcode = avio_rb16(pb);
@@ -235,13 +237,18 @@ static int mov_metadata_loci(MOVContext *c, AVIOContext *pb, unsigned len)
len -= 6;
len -= avio_get_str(pb, len, buf, sizeof(buf)); // place name
- if (len < 1)
+ if (len < 1) {
+ av_log(c->fc, AV_LOG_ERROR, "place name too long\n");
return AVERROR_INVALIDDATA;
+ }
avio_skip(pb, 1); // role
len -= 1;
- if (len < 14)
+ if (len < 14) {
+ av_log(c->fc, AV_LOG_ERROR,
+ "loci too short (%u bytes left, need at least %d)\n", len, 14);
return AVERROR_INVALIDDATA;
+ }
longitude = ((int32_t) avio_rb32(pb)) / (float) (1 << 16);
latitude = ((int32_t) avio_rb32(pb)) / (float) (1 << 16);