From 55d66b27902d3f566cd6cf6f08d4233dcdc338f5 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 17 Jan 2013 18:52:35 +0100 Subject: [PATCH] movenc: check that fps for tmcd is within encodable range. The fps is stored as a 8 bit value thus 255 is the maximum encodable. Signed-off-by: Michael Niedermayer --- libavformat/movenc.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavformat/movenc.c b/libavformat/movenc.c index d9b002e0b5..1b851c03dd 100644 --- a/libavformat/movenc.c +++ b/libavformat/movenc.c @@ -1149,6 +1149,11 @@ static int mov_write_tmcd_tag(AVIOContext *pb, MOVTrack *track) int frame_duration = av_rescale(track->timescale, track->enc->time_base.num, track->enc->time_base.den); int nb_frames = 1.0/av_q2d(track->enc->time_base) + 0.5; + if (nb_frames > 255) { + av_log(NULL, AV_LOG_ERROR, "fps %d is too large\n", nb_frames); + return AVERROR(EINVAL); + } + avio_wb32(pb, 0); /* size */ ffio_wfourcc(pb, "tmcd"); /* Data format */ avio_wb32(pb, 0); /* Reserved */