mov: Discard invalid CTTS.
authorMichael Niedermayer <michaelni@gmx.at>
Thu, 8 Mar 2012 06:10:57 +0000 (07:10 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Thu, 8 Mar 2012 20:31:45 +0000 (21:31 +0100)
Fixes Ticket385

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavformat/mov.c

index 3ca1f97..de290aa 100644 (file)
@@ -1774,6 +1774,14 @@ static int mov_read_ctts(MOVContext *c, AVIOContext *pb, MOVAtom atom)
 
         sc->ctts_data[i].count   = count;
         sc->ctts_data[i].duration= duration;
+
+        if (FFABS(duration) > (1<<28) && i+2<entries) {
+            av_log(c->fc, AV_LOG_WARNING, "CTTS invalid\n");
+            av_freep(&sc->ctts_data);
+            sc->ctts_count = 0;
+            return 0;
+        }
+
         if (duration < 0 && i+2<entries)
             sc->dts_shift = FFMAX(sc->dts_shift, -duration);
     }