[FFmpeg-cvslog] avcodec/movtextdec: Fix tsmb_size check==0 check

[Michael Niedermayer]

ffmpeg | branch: release/3.0 | Michael Niedermayer <michael at niedermayer.cc> | Tue Nov 15 14:52:21 2016 +0100| [3f9a24f06d5df3c52c7cec0e29ab273946388992] | committer: Michael Niedermayer

avcodec/movtextdec: Fix tsmb_size check==0 check

Fixes: 173/fuzz-3-ffmpeg_SUBTITLE_AV_CODEC_ID_MOV_TEXT_fuzzer

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
(cherry picked from commit a609905723c01e356d35146425c3d45c090aae7b)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3f9a24f06d5df3c52c7cec0e29ab273946388992
---

 libavcodec/movtextdec.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/libavcodec/movtextdec.c b/libavcodec/movtextdec.c
index 9c41953..3faebb3 100644
--- a/libavcodec/movtextdec.c
+++ b/libavcodec/movtextdec.c
@@ -477,10 +477,6 @@ static int mov_text_decode_frame(AVCodecContext *avctx,
             tsmb_type = AV_RB32(tsmb);
             tsmb += 4;
 
-            if (tsmb_size == 0) {
-              return AVERROR_INVALIDDATA;
-            }
-
             if (tsmb_size == 1) {
                 if (m->tracksize + 16 > avpkt->size)
                     break;
@@ -491,6 +487,10 @@ static int mov_text_decode_frame(AVCodecContext *avctx,
                 m->size_var = 8;
             //size_var is equal to 8 or 16 depending on the size of box
 
+            if (tsmb_size == 0) {
+                return AVERROR_INVALIDDATA;
+            }
+
             if (tsmb_size > avpkt->size - m->tracksize)
                 break;