[FFmpeg-cvslog] avformat/mov: Check ctts_count before use

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Wed Feb 25 13:00:51 2015 +0100| [bbbc8c618884a838c00faaaa91898017dd431117] | committer: Michael Niedermayer

avformat/mov: Check ctts_count before use

Fixes out of array read
Fixes: asan_heap-oob_ae74b5_3610_cov_1739568095_test.3g2

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=bbbc8c618884a838c00faaaa91898017dd431117
---

 libavformat/mov.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 3d68ac8..5ff753d 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -4191,7 +4191,11 @@ static AVIndexEntry *mov_find_next_sample(AVFormatContext *s, AVStream **st)
         if (msc->pb && msc->current_sample < avst->nb_index_entries) {
             AVIndexEntry *current_sample = &avst->index_entries[msc->current_sample];
             int64_t dts;
-            if (msc->ctts_data)
+
+            if (msc->ctts_data && msc->ctts_index >= msc->ctts_count)
+                av_log(s, AV_LOG_WARNING, "CTTS list too small\n");
+
+            if (msc->ctts_data && msc->ctts_index < msc->ctts_count)
                 dts = av_rescale(current_sample->timestamp - msc->dts_shift - msc->ctts_data[msc->ctts_index].duration,
                                  AV_TIME_BASE, msc->time_scale);
             else