diff options
| author | Aaron Colwell <acolwell@google.com> | 2017-01-27 09:33:29 -0800 |
|---|---|---|
| committer | Vittorio Giovara <vittorio.giovara@gmail.com> | 2017-03-07 11:07:01 -0500 |
| commit | 17adcc40adf1f30cba55c9727dabc1365944d32b (patch) | |
| tree | bf2fa910e2fc4aba8fe859a6e3d79fe0a47a31ce /libavformat | |
| parent | 81bffae368f331b6cd386a814f225a58e3f32f40 (diff) | |
mov: Fix spherical metadata_source parsing
Signed-off-by: James Almer <jamrial@gmail.com>
Diffstat (limited to 'libavformat')
| -rw-r--r-- | libavformat/mov.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavformat/mov.c b/libavformat/mov.c index 5c9f85c738..d5de5d6b13 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -3252,7 +3252,7 @@ static int mov_read_sv3d(MOVContext *c, AVIOContext *pb, MOVAtom atom) } size = avio_rb32(pb); - if (size > atom.size) + if (size <= 12 || size > atom.size) return AVERROR_INVALIDDATA; tag = avio_rl32(pb); @@ -3261,7 +3261,7 @@ static int mov_read_sv3d(MOVContext *c, AVIOContext *pb, MOVAtom atom) return 0; } avio_skip(pb, 4); /* version + flags */ - avio_skip(pb, avio_r8(pb)); /* metadata_source */ + avio_skip(pb, size - 12); /* metadata_source */ size = avio_rb32(pb); if (size > atom.size) |