From a593d2e92e1491ec04f315d9e38b001b74dcf0b4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Storsj=C3=B6?= Date: Mon, 15 Jul 2013 17:13:54 +0300 Subject: [PATCH] mov: Do not allow updating the time scale after it has been set MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The time scale is set in mdhd, and later validated in the enclosing trak atom once all of its children have been parsed. A loose mdhd atom outside of a trak atom could update the time scale of the last stream without any validation. Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Cc: libav-stable@libav.org Signed-off-by: Martin Storsjö (cherry picked from commit 31931520df35a6f9606fe8293c8a39e2d1fabedf) Signed-off-by: Luca Barbato --- libavformat/mov.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavformat/mov.c b/libavformat/mov.c index 1dbf63f91f..0e5d473a8b 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -736,6 +736,11 @@ static int mov_read_mdhd(MOVContext *c, AVIOContext *pb, MOVAtom atom) st = c->fc->streams[c->fc->nb_streams-1]; sc = st->priv_data; + if (sc->time_scale) { + av_log(c->fc, AV_LOG_ERROR, "Multiple mdhd?\n"); + return AVERROR_INVALIDDATA; + } + version = avio_r8(pb); if (version > 1) { av_log_ask_for_sample(c, "unsupported version %d\n", version);