mov: Make sure the read sample count is nonnegative
authorMartin Storsjö <martin@martin.st>
Sat, 28 Sep 2013 20:57:36 +0000 (23:57 +0300)
committerMartin Storsjö <martin@martin.st>
Sun, 29 Sep 2013 17:00:45 +0000 (20:00 +0300)
This avoids setting a negative number of frames, ending up with a
negative average frame rate.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
libavformat/mov.c

index c3d857b..e1f2db2 100644 (file)
@@ -1724,6 +1724,10 @@ static int mov_read_stts(MOVContext *c, AVIOContext *pb, MOVAtom atom)
 
         sample_count=avio_rb32(pb);
         sample_duration = avio_rb32(pb);
+        if (sample_count < 0) {
+            av_log(c->fc, AV_LOG_ERROR, "Invalid sample_count=%d\n", sample_count);
+            return AVERROR_INVALIDDATA;
+        }
         sc->stts_data[i].count= sample_count;
         sc->stts_data[i].duration= sample_duration;