From 86f2ae06b92d42580ae7ebd86d52c9b7acbc2f13 Mon Sep 17 00:00:00 2001 From: Alex Converse Date: Wed, 21 Mar 2012 11:24:10 -0700 Subject: mov: Do not read past the end of the ctts_data table. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org --- libavformat/mov.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'libavformat') diff --git a/libavformat/mov.c b/libavformat/mov.c index 7b21423afa..75dec37872 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -2713,7 +2713,7 @@ static int mov_read_packet(AVFormatContext *s, AVPacket *pkt) pkt->stream_index = sc->ffindex; pkt->dts = sample->timestamp; - if (sc->ctts_data) { + if (sc->ctts_data && sc->ctts_index < sc->ctts_count) { pkt->pts = pkt->dts + sc->dts_shift + sc->ctts_data[sc->ctts_index].duration; /* update ctts context */ sc->ctts_sample++; -- cgit v1.2.3