Merge commit 'c231987662194d009dd91bfc57c678e0e70ca161'

* commit 'c231987662194d009dd91bfc57c678e0e70ca161':
  mov: Make sure the read sample count is nonnegative

Conflicts:
	libavformat/mov.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 5 insertions, 0 deletions

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 895af18576..8b1ef01dfd 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -1922,11 +1922,16 @@ static int mov_read_stts(MOVContext *c, AVIOContext *pb, MOVAtom atom)
 
         sample_count=avio_rb32(pb);
         sample_duration = avio_rb32(pb);
+
         /* sample_duration < 0 is invalid based on the spec */
         if (sample_duration < 0) {
             av_log(c->fc, AV_LOG_ERROR, "Invalid SampleDelta in STTS %d\n", sample_duration);
             sample_duration = 1;
         }
+        if (sample_count < 0) {
+            av_log(c->fc, AV_LOG_ERROR, "Invalid sample_count=%d\n", sample_count);
+            return AVERROR_INVALIDDATA;
+        }
         sc->stts_data[i].count= sample_count;
         sc->stts_data[i].duration= sample_duration;