Do not try to read total disc or track number if data atom is too short.

Fixes ticket #659.

1 files changed, 3 insertions, 2 deletions

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 668ff89b4f..e940427685 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -87,10 +87,11 @@ static int mov_metadata_track_or_disc_number(MOVContext *c, AVIOContext *pb,
 {
     char buf[16];
 
-    short current, total;
+    short current, total = 0;
     avio_rb16(pb); // unknown
     current = avio_rb16(pb);
-    total = avio_rb16(pb);
+    if (len >= 6)
+        total = avio_rb16(pb);
     if (!total)
         snprintf(buf, sizeof(buf), "%d", current);
     else