lavf/mov: ensure only one tkhd per trak
authorchcunningham <chcunningham@chromium.org>
Thu, 13 Dec 2018 21:58:40 +0000 (13:58 -0800)
committerMichael Niedermayer <michael@niedermayer.cc>
Thu, 21 Mar 2019 09:42:51 +0000 (10:42 +0100)
commit5d9daae62b9c1a669a504433b78d5a3e75409089
treea2376387ac52dd9ed4b0d8f31900d756d688e87a
parent50ee16431c56562225cde14f4250e60e86dbfd9c
lavf/mov: ensure only one tkhd per trak

Chromium fuzzing produced a whacky file with extra tkhds. This caused
an AVStream that was already in use to be corrupted by assigning it a
new id, which blows up later in mov_read_trun because the
MOVFragmentStreamInfo.index_entry now points OOB.

Reviewed-by: Baptiste Coudurier <baptiste.coudurier@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c9f7b6f7a9fdffa0ab8f3aa84a1f701cf5b3a6e9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavformat/mov.c