Fix near infinite loop in stsd parsing. Bug found by: Diana Elena Muscalu The size is unsigned according the specification.
Unified · Split
| @@ -1098,13 +1098,16 @@ int ff_mov_read_stsd_entries(MOVContext *c, AVIOContext *pb, int entries) · 1097 unmodified lines | |||
| 1098 | int dref_id = 1; | 1098 | int dref_id = 1; |
| 1099 | MOVAtom a = { AV_RL32("stsd") }; | 1099 | MOVAtom a = { AV_RL32("stsd") }; |
| 1100 | int64_t start_pos = avio_tell(pb); | 1100 | int64_t start_pos = avio_tell(pb); |
| 1101 | int size = avio_rb32(pb); /* size */ | 1101 | uint32_t size = avio_rb32(pb); /* size */ |
| 1102 | uint32_t format = avio_rl32(pb); /* data format */ | 1102 | uint32_t format = avio_rl32(pb); /* data format */ |
| 1103 | 1103 | ||
| 1104 | if (size >= 16) { | 1104 | if (size >= 16) { |
| 1105 | avio_rb32(pb); /* reserved */ | 1105 | avio_rb32(pb); /* reserved */ |
| 1106 | avio_rb16(pb); /* reserved */ | 1106 | avio_rb16(pb); /* reserved */ |
| 1107 | dref_id = avio_rb16(pb); | 1107 | dref_id = avio_rb16(pb); |
| 1108 | } else { | ||
| 1109 | av_log(c->fc, AV_LOG_ERROR, "invalid size %d in stsd\n", size); | ||
| 1110 | return AVERROR_INVALIDDATA; | ||
| 1108 | } | 1111 | } |
| 1109 | 1112 | ||
| 1110 | if (st->codec->codec_tag && | 1113 | if (st->codec->codec_tag && |