lavf/mov: ensure only one tkhd per trak
authorchcunningham <chcunningham@chromium.org>
Thu, 13 Dec 2018 21:58:40 +0000 (13:58 -0800)
committerMichael Niedermayer <michael@niedermayer.cc>
Mon, 14 Jan 2019 23:57:27 +0000 (00:57 +0100)
commit418f13261ffe9390a23271365978730512f1cbe5
tree500dbe30c65af60f3ca8b4a2476177bc8d411ec5
parent3c2207b10f0e29f849f098faa9f8426e086bfaad
lavf/mov: ensure only one tkhd per trak

Chromium fuzzing produced a whacky file with extra tkhds. This caused
an AVStream that was already in use to be corrupted by assigning it a
new id, which blows up later in mov_read_trun because the
MOVFragmentStreamInfo.index_entry now points OOB.

Reviewed-by: Baptiste Coudurier <baptiste.coudurier@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c9f7b6f7a9fdffa0ab8f3aa84a1f701cf5b3a6e9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavformat/mov.c