Traneptora/FFmpeg
1
Fork 0
forked from FFmpeg/FFmpeg
Code Pull requests Activity

check that nb_streams is valid before setting stream, fix crash with jp2 which do not use same structure

Browse source 
Originally committed as revision 16166 to svn://svn.ffmpeg.org/ffmpeg/trunk
This commit is contained in:
Baptiste Coudurier 2008-12-16 08:47:28 +00:00
parent f683ea1cab
commit 271344377a
1 changed files with 7 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
libavformat/mov.c
View file

@ -599,9 +599,14 @@ static int mov_read_enda(MOVContext *c, ByteIOContext *pb, MOVAtom atom)
/* FIXME modify qdm2/svq3/h264 decoders to take full atom as extradata */ /* FIXME modify qdm2/svq3/h264 decoders to take full atom as extradata */
static int mov_read_extradata(MOVContext *c, ByteIOContext *pb, MOVAtom atom) static int mov_read_extradata(MOVContext *c, ByteIOContext *pb, MOVAtom atom)
{ {
AVStream *st = c->fc->streams[c->fc->nb_streams-1]; AVStream *st;
uint64_t size= (uint64_t)st->codec->extradata_size + atom.size + 8 + FF_INPUT_BUFFER_PADDING_SIZE; uint64_t size;
uint8_t *buf; uint8_t *buf;
if (c->fc->nb_streams < 1) // will happen with jp2 files
return 0;
st= c->fc->streams[c->fc->nb_streams-1];
size= (uint64_t)st->codec->extradata_size + atom.size + 8 + FF_INPUT_BUFFER_PADDING_SIZE;
if(size > INT_MAX || (uint64_t)atom.size > INT_MAX) if(size > INT_MAX || (uint64_t)atom.size > INT_MAX)
return -1; return -1;
buf= av_realloc(st->codec->extradata, size); buf= av_realloc(st->codec->extradata, size);