avformat/mov: Check size of STSC allocation

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

avformat/mov: Check size of STSC allocation
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
a6fdd75f · Fredrik Hubinette · Michael Niedermayer · ac922f94 · a6fdd75f
Commit a6fdd75f authored Nov 16, 2017 by Fredrik Hubinette Committed by Michael Niedermayer Nov 16, 2017
Show whitespace changes
Inline Side-by-side

Showing with 2 additions and 0 deletions

mov.c libavformat/mov.c +2 -0

No files found.
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -2595,6 +2595,8 @@ static int mov_read_stsc(MOVContext *c, AVIOContext *pb, MOVAtom atom)
    avio_rb24(pb); /* flags */

    entries = avio_rb32(pb);
+    if ((uint64_t)entries * 12 + 4 > atom.size)
+        return AVERROR_INVALIDDATA;

    av_log(c->fc, AV_LOG_TRACE, "track[%u].stsc.entries = %u\n", c->fc->nb_streams - 1, entries);