[FFmpeg-devel] [PATCH] avformat/mov: ensure no trun atoms are parsed as children of trak

[James Almer]

Fixes: Null-dereference READ
Fixes: 396192874/clusterfuzz-testcase-minimized-audio_decoder_fuzzer-4589309789143040

Signed-off-by: James Almer <jamrial at gmail.com>
---
 libavformat/mov.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 85aef33b19..f675929e57 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -5097,6 +5097,12 @@ static int sanity_checks(void *log_obj, MOVStreamContext *sc, int index)
         return 1;
     }
 
+    if (sc->tts_count) {
+        av_log(log_obj, AV_LOG_ERROR, "stream %d, TRUN atom in TRAK, broken header\n",
+               index);
+        return 1;
+    }
+
     if (sc->stsc_count && sc->stsc_data[ sc->stsc_count - 1 ].first > sc->chunk_count) {
         av_log(log_obj, AV_LOG_ERROR, "stream %d, contradictionary STSC and STCO\n",
                index);
-- 
2.48.1