RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

lavf/mov: don't read outside frag_index bounds 

Potentially fixes:
https://bugs.chromium.org/p/chromium/issues/detail?id=786269#c1

In theory, the crash can be triggered by an invalid stream that has
either tfdt or trun outside of the moof

Reviewed-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
John Stebbins 2017-11-17 08:21:02 -08:00 committed by Michael Niedermayer
parent 5eaaffaf64
commit 20c38f2e70
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libavformat/mov.c
View File

@ -1188,6 +1188,10 @@ static void set_frag_stream(MOVFragmentIndex *frag_index, int id)
static MOVFragmentStreamInfo * get_current_frag_stream_info(
MOVFragmentIndex *frag_index)
{
if (frag_index->current < 0 ||
frag_index->current >= frag_index->nb_items)
return NULL;
MOVFragmentIndexItem * item = &frag_index->item[frag_index->current];
if (item->current >= 0 && item->current < item->nb_stream_info)
return &item->stream_info[item->current];