diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-03-08 10:10:57 +0400 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-03-09 00:31:45 +0400 |
| commit | 4093220029a4d77f272c491e9299680480a08c00 (patch) | |
| tree | 0b9c2ba7b8e4d07594aa9178db79018148dd5e5a /libavformat/mov.c | |
| parent | 15d75dabee81536255f05996abf1f0b8af632d30 (diff) | |
mov: Discard invalid CTTS.
Fixes Ticket385
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat/mov.c')
| -rw-r--r-- | libavformat/mov.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/libavformat/mov.c b/libavformat/mov.c index 3ca1f97658..de290aa70c 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -1774,6 +1774,14 @@ static int mov_read_ctts(MOVContext *c, AVIOContext *pb, MOVAtom atom) sc->ctts_data[i].count = count; sc->ctts_data[i].duration= duration; + + if (FFABS(duration) > (1<<28) && i+2<entries) { + av_log(c->fc, AV_LOG_WARNING, "CTTS invalid\n"); + av_freep(&sc->ctts_data); + sc->ctts_count = 0; + return 0; + } + if (duration < 0 && i+2<entries) sc->dts_shift = FFMAX(sc->dts_shift, -duration); } |