lavf/mov: ensure only one tkhd per trak
authorchcunningham <chcunningham@chromium.org>
Thu, 13 Dec 2018 21:58:40 +0000 (13:58 -0800)
committerMichael Niedermayer <michael@niedermayer.cc>
Sun, 16 Dec 2018 08:49:07 +0000 (09:49 +0100)
commitc9f7b6f7a9fdffa0ab8f3aa84a1f701cf5b3a6e9
tree798321952ca7ff57df2c9fe2d3f1d0e702ee43d1
parent436bffaca2312ce1b0fae149c50e77e411bcaa8e
lavf/mov: ensure only one tkhd per trak

Chromium fuzzing produced a whacky file with extra tkhds. This caused
an AVStream that was already in use to be corrupted by assigning it a
new id, which blows up later in mov_read_trun because the
MOVFragmentStreamInfo.index_entry now points OOB.

Reviewed-by: Baptiste Coudurier <baptiste.coudurier@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavformat/mov.c