if sc->tts_count is 0, this condition will wrap around to UINT_MAX and the code will try to dereference a NULL pointer. Fixes ticket #11417
Unified · Split
| @@ -5191,7 +5191,7 @@ static int mov_read_trak(MOVContext *c, AVIOContext *pb, MOVAtom atom) · 5190 unmodified lines | |||
| 5191 | } | 5191 | } |
| 5192 | 5192 | ||
| 5193 | #if FF_API_R_FRAME_RATE | 5193 | #if FF_API_R_FRAME_RATE |
| 5194 | for (int i = 1; sc->stts_count && i < sc->tts_count - 1; i++) { | 5194 | for (unsigned int i = 1; sc->stts_count && i + 1 < sc->tts_count; i++) { |
| 5195 | if (sc->tts_data[i].duration == sc->tts_data[0].duration) | 5195 | if (sc->tts_data[i].duration == sc->tts_data[0].duration) |
| 5196 | continue; | 5196 | continue; |
| 5197 | stts_constant = 0; | 5197 | stts_constant = 0; |