[FFmpeg-cvslog] mov: Make sure the read sample count is nonnegative

[Martin Storsjö]

ffmpeg | branch: release/1.1 | Martin Storsjö <martin at martin.st> | Sat Sep 28 23:57:36 2013 +0300| [c10f3fed259c23e6887f68cdf3e7d4ae87026f65] | committer: Luca Barbato

mov: Make sure the read sample count is nonnegative

This avoids setting a negative number of frames, ending up with a
negative average frame rate.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable at libav.org
Signed-off-by: Martin Storsjö <martin at martin.st>
(cherry picked from commit c231987662194d009dd91bfc57c678e0e70ca161)
Signed-off-by: Luca Barbato <lu_zero at gentoo.org>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c10f3fed259c23e6887f68cdf3e7d4ae87026f65
---

 libavformat/mov.c |    4 ++++
 1 file changed, 4 insertions(+)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 2ae19c9..6b89a2d 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -1659,6 +1659,10 @@ static int mov_read_stts(MOVContext *c, AVIOContext *pb, MOVAtom atom)
 
         sample_count=avio_rb32(pb);
         sample_duration = avio_rb32(pb);
+        if (sample_count < 0) {
+            av_log(c->fc, AV_LOG_ERROR, "Invalid sample_count=%d\n", sample_count);
+            return AVERROR_INVALIDDATA;
+        }
         sc->stts_data[i].count= sample_count;
         sc->stts_data[i].duration= sample_duration;