Fix near infinite loop in stsd parsing. Bug found by: Diana Elena Muscalu The size is unsigned according the specification.
Unified · Split
| @@ -1098,13 +1098,16 @@ int ff_mov_read_stsd_entries(MOVContext *c, AVIOContext *pb, int entries) · 1097 unmodified lines | ||
| 1098 | 1098 | int dref_id = 1; |
| 1099 | 1099 | MOVAtom a = { AV_RL32("stsd") }; |
| 1100 | 1100 | int64_t start_pos = avio_tell(pb); |
| 1101 | − int size = avio_rb32(pb); /* size */ | |
| 1101 | + uint32_t size = avio_rb32(pb); /* size */ | |
| 1102 | 1102 | uint32_t format = avio_rl32(pb); /* data format */ |
| 1103 | 1103 | |
| 1104 | 1104 | if (size >= 16) { |
| 1105 | 1105 | avio_rb32(pb); /* reserved */ |
| 1106 | 1106 | avio_rb16(pb); /* reserved */ |
| 1107 | 1107 | dref_id = avio_rb16(pb); |
| 1108 | + } else { | |
| 1109 | + av_log(c->fc, AV_LOG_ERROR, "invalid size %d in stsd\n", size); | |
| 1110 | + return AVERROR_INVALIDDATA; | |
| 1108 | 1111 | } |
| 1109 | 1112 | |
| 1110 | 1113 | if (st->codec->codec_tag && |