Merge commit '577f1feb3fd1e51fd14af7ce6d79d468faa3b929' into release/2.4
authorMichael Niedermayer <michaelni@gmx.at>
Sat, 20 Dec 2014 10:48:28 +0000 (11:48 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Sat, 20 Dec 2014 10:49:03 +0000 (11:49 +0100)
* commit '577f1feb3fd1e51fd14af7ce6d79d468faa3b929':
  mov: avoid a memleak when multiple stss boxes are present

Conflicts:
libavformat/mov.c

See: 1b5d11240692025f036e945bc37968735679320a
See: 5ab882d7283f57560c889919c35f2688253b1d9c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
1  2 
libavformat/mov.c

@@@ -1846,15 -1698,12 +1846,17 @@@ static int mov_read_stss(MOVContext *c
      if (!entries)
      {
          sc->keyframe_absent = 1;
 +        if (!st->need_parsing && st->codec->codec_type == AVMEDIA_TYPE_VIDEO)
 +            st->need_parsing = AVSTREAM_PARSE_HEADERS;
          return 0;
      }
-         av_log(c->fc, AV_LOG_WARNING, "Duplicate STSS atom\n");
-     av_free(sc->keyframes);
 +    if (sc->keyframes)
 -    sc->keyframes = av_malloc(entries * sizeof(int));
++        av_log(c->fc, AV_LOG_WARNING, "Duplicated STSS atom\n");
+     if (entries >= UINT_MAX / sizeof(int))
+         return AVERROR_INVALIDDATA;
+     av_freep(&sc->keyframes);
 +    sc->keyframe_count = 0;
 +    sc->keyframes = av_malloc_array(entries, sizeof(*sc->keyframes));
      if (!sc->keyframes)
          return AVERROR(ENOMEM);