diff --git a/packages/multimedia/ffmpeg/patches/ffmpeg-99.1005-replace-a-value-error-by-clipping-into-valid-range-in-mov_read_stsc.patch b/packages/multimedia/ffmpeg/patches/ffmpeg-99.1005-replace-a-value-error-by-clipping-into-valid-range-in-mov_read_stsc.patch new file mode 100644 index 0000000000..61a332d933 --- /dev/null +++ b/packages/multimedia/ffmpeg/patches/ffmpeg-99.1005-replace-a-value-error-by-clipping-into-valid-range-in-mov_read_stsc.patch @@ -0,0 +1,42 @@ +From: Michael Niedermayer +Date: Mon, 21 May 2018 01:16:58 +0000 (+0200) +Subject: avformat/mov: replace a value error by clipping into valid range in mov_read_stsc() +X-Git-Url: http://git.videolan.org/?p=ffmpeg.git;a=commitdiff_plain;h=fe84f70819d6f5aab3c4823290e0d32b99d6de78 + +avformat/mov: replace a value error by clipping into valid range in mov_read_stsc() + +Fixes: #7165 + +Signed-off-by: Michael Niedermayer +--- + +diff --git a/libavformat/mov.c b/libavformat/mov.c +index a078bf4712..f2a540ad50 100644 +--- a/libavformat/mov.c ++++ b/libavformat/mov.c +@@ -2642,14 +2642,22 @@ static int mov_read_stsc(MOVContext *c, AVIOContext *pb, MOVAtom atom) + + sc->stsc_count = i; + for (i = sc->stsc_count - 1; i < UINT_MAX; i--) { ++ int64_t first_min = i + 1; + if ((i+1 < sc->stsc_count && sc->stsc_data[i].first >= sc->stsc_data[i+1].first) || + (i > 0 && sc->stsc_data[i].first <= sc->stsc_data[i-1].first) || +- sc->stsc_data[i].first < 1 || ++ sc->stsc_data[i].first < first_min || + sc->stsc_data[i].count < 1 || + sc->stsc_data[i].id < 1) { + av_log(c->fc, AV_LOG_WARNING, "STSC entry %d is invalid (first=%d count=%d id=%d)\n", i, sc->stsc_data[i].first, sc->stsc_data[i].count, sc->stsc_data[i].id); +- if (i+1 >= sc->stsc_count || sc->stsc_data[i+1].first < 2) +- return AVERROR_INVALIDDATA; ++ if (i+1 >= sc->stsc_count) { ++ sc->stsc_data[i].first = FFMAX(sc->stsc_data[i].first, first_min); ++ if (i > 0 && sc->stsc_data[i].first <= sc->stsc_data[i-1].first) ++ sc->stsc_data[i].first = FFMIN(sc->stsc_data[i-1].first + 1LL, INT_MAX); ++ sc->stsc_data[i].count = FFMAX(sc->stsc_data[i].count, 1); ++ sc->stsc_data[i].id = FFMAX(sc->stsc_data[i].id, 1); ++ continue; ++ } ++ av_assert0(sc->stsc_data[i+1].first >= 2); + // We replace this entry by the next valid + sc->stsc_data[i].first = sc->stsc_data[i+1].first - 1; + sc->stsc_data[i].count = sc->stsc_data[i+1].count;