From bbbc8c618884a838c00faaaa91898017dd431117 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 25 Feb 2015 13:00:51 +0100 Subject: [PATCH] avformat/mov: Check ctts_count before use Fixes out of array read Fixes: asan_heap-oob_ae74b5_3610_cov_1739568095_test.3g2 Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer --- libavformat/mov.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 3d68ac80a3..5ff753d5c8 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -4191,7 +4191,11 @@ static AVIndexEntry *mov_find_next_sample(AVFormatContext *s, AVStream **st) if (msc->pb && msc->current_sample < avst->nb_index_entries) { AVIndexEntry *current_sample = &avst->index_entries[msc->current_sample]; int64_t dts; - if (msc->ctts_data) + + if (msc->ctts_data && msc->ctts_index >= msc->ctts_count) + av_log(s, AV_LOG_WARNING, "CTTS list too small\n"); + + if (msc->ctts_data && msc->ctts_index < msc->ctts_count) dts = av_rescale(current_sample->timestamp - msc->dts_shift - msc->ctts_data[msc->ctts_index].duration, AV_TIME_BASE, msc->time_scale); else