[12/17] mov: Make sure the read sample count is nonnegative

Message ID 1380406879-6174-12-git-send-email-martin@martin.st
State Committed
Commit c231987662194d009dd91bfc57c678e0e70ca161
Headers show

Commit Message

Martin Storsjö Sept. 28, 2013, 10:21 p.m.
This avoids setting a negative number of frames, ending up with a
negative average frame rate.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
---
 libavformat/mov.c |    4 ++++
 1 file changed, 4 insertions(+)

Comments

Luca Barbato Sept. 29, 2013, 3:50 a.m. | #1
On 29/09/13 00:21, Martin Storsjö wrote:
> This avoids setting a negative number of frames, ending up with a
> negative average frame rate.
> 
> Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
> CC: libav-stable@libav.org
> ---
>  libavformat/mov.c |    4 ++++
>  1 file changed, 4 insertions(+)
> 

Ok.

Patch

diff --git a/libavformat/mov.c b/libavformat/mov.c
index c3d857b..e1f2db2 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -1724,6 +1724,10 @@  static int mov_read_stts(MOVContext *c, AVIOContext *pb, MOVAtom atom)
 
         sample_count=avio_rb32(pb);
         sample_duration = avio_rb32(pb);
+        if (sample_count < 0) {
+            av_log(c->fc, AV_LOG_ERROR, "Invalid sample_count=%d\n", sample_count);
+            return AVERROR_INVALIDDATA;
+        }
         sc->stts_data[i].count= sample_count;
         sc->stts_data[i].duration= sample_duration;