From a7f27453f64d9020b92b01687baeb5909c6cdad0 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michaelni@gmx.at>
Date: Fri, 22 Nov 2013 20:09:03 +0100
Subject: [PATCH] avformat/mov: Check that we have a stream before accessing it
in mov_read_ares()
Fixes out of array read
Fixes: signal_sigsegv_6f1855_3910_avid_test_alpha.mov
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
---
libavformat/mov.c | 20 +++++++++++---------
1 file changed, 11 insertions(+), 9 deletions(-)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 3da31ac6290..bb141c8a2a1 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -1042,15 +1042,17 @@ static int mov_read_targa_y216(MOVContext *c, AVIOContext *pb, MOVAtom atom)
static int mov_read_ares(MOVContext *c, AVIOContext *pb, MOVAtom atom)
{
- AVCodecContext *codec = c->fc->streams[c->fc->nb_streams-1]->codec;
- if (codec->codec_tag == MKTAG('A', 'V', 'i', 'n') &&
- codec->codec_id == AV_CODEC_ID_H264 &&
- atom.size > 11) {
- avio_skip(pb, 10);
- /* For AVID AVCI50, force width of 1440 to be able to select the correct SPS and PPS */
- if (avio_rb16(pb) == 0xd4d)
- codec->width = 1440;
- return 0;
+ if (c->fc->nb_streams >= 1) {
+ AVCodecContext *codec = c->fc->streams[c->fc->nb_streams-1]->codec;
+ if (codec->codec_tag == MKTAG('A', 'V', 'i', 'n') &&
+ codec->codec_id == AV_CODEC_ID_H264 &&
+ atom.size > 11) {
+ avio_skip(pb, 10);
+ /* For AVID AVCI50, force width of 1440 to be able to select the correct SPS and PPS */
+ if (avio_rb16(pb) == 0xd4d)
+ codec->width = 1440;
+ return 0;
+ }
}
return mov_read_avid(c, pb, atom);
--
GitLab