From 42fc4aabccb5b5da0db2fd312187d90b303e96f7 Mon Sep 17 00:00:00 2001
From: Carl Eugen Hoyos <ceffmpeg@gmail.com>
Date: Sun, 31 Dec 2017 22:25:29 +0100
Subject: [PATCH] lavf/mov: Use av_fast_realloc() in mov_read_stts().
Avoids large allocations for short files with invalid stts entry.
Fixes bugzilla 1102.
---
libavformat/mov.c | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)
@@ -2848,15 +2848,24 @@ static int mov_read_stts(MOVContext *c, AVIOContext *pb, MOVAtom atom)
if (sc->stts_data)
av_log(c->fc, AV_LOG_WARNING, "Duplicated STTS atom\n");
- av_free(sc->stts_data);
+ av_freep(&sc->stts_data);
sc->stts_count = 0;
- sc->stts_data = av_malloc_array(entries, sizeof(*sc->stts_data));
- if (!sc->stts_data)
+ if (entries >= INT_MAX / sizeof(*sc->stts_data))
return AVERROR(ENOMEM);
for (i = 0; i < entries && !pb->eof_reached; i++) {
int sample_duration;
unsigned int sample_count;
+ unsigned alloc_size = 0, min_entries = FFMIN(FFMAX(i, 1024 * 1024), entries);
+ MOVStts *stts_data = av_fast_realloc(sc->stts_data, &alloc_size,
+ min_entries * sizeof(*sc->stts_data));
+ if (!stts_data) {
+ av_freep(&sc->stts_data);
+ sc->stts_count = 0;
+ return AVERROR(ENOMEM);
+ }
+ sc->stts_count = min_entries;
+ sc->stts_data = stts_data;
sample_count=avio_rb32(pb);
sample_duration = avio_rb32(pb);
--
1.7.10.4