mirror of
https://github.com/FFmpeg/FFmpeg.git
synced 2024-12-23 12:43:46 +02:00
check atom size against edit_count to avoid very long loop
Originally committed as revision 19198 to svn://svn.ffmpeg.org/ffmpeg/trunk
This commit is contained in:
parent
7060667580
commit
53e099de8b
@ -1831,6 +1831,9 @@ static int mov_read_elst(MOVContext *c, ByteIOContext *pb, MOVAtom atom)
|
||||
get_be24(pb); /* flags */
|
||||
edit_count = get_be32(pb); /* entries */
|
||||
|
||||
if((uint64_t)edit_count*12+8 > atom.size)
|
||||
return -1;
|
||||
|
||||
for(i=0; i<edit_count; i++){
|
||||
int time;
|
||||
int duration = get_be32(pb); /* Track duration */
|
||||
|
Loading…
Reference in New Issue
Block a user