[FFmpeg-devel] [PATCH] mov: Discard invalid CTTS.

[Michael Niedermayer]

Fixes Ticket385

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
---
 libavformat/mov.c |    8 ++++++++
 1 files changed, 8 insertions(+), 0 deletions(-)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 3ca1f97..de290aa 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -1774,6 +1774,14 @@ static int mov_read_ctts(MOVContext *c, AVIOContext *pb, MOVAtom atom)
 
         sc->ctts_data[i].count   = count;
         sc->ctts_data[i].duration= duration;
+
+        if (FFABS(duration) > (1<<28) && i+2<entries) {
+            av_log(c->fc, AV_LOG_WARNING, "CTTS invalid\n");
+            av_freep(&sc->ctts_data);
+            sc->ctts_count = 0;
+            return 0;
+        }
+
         if (duration < 0 && i+2<entries)
             sc->dts_shift = FFMAX(sc->dts_shift, -duration);
     }
-- 
1.7.5.4