@ -915,6 +915,8 @@ static int mov_read_stco(MOVContext *c, AVIOContext *pb, MOVAtom atom)
entries = avio_rb32 ( pb ) ;
if ( ! entries )
return 0 ;
if ( entries > = UINT_MAX / sizeof ( int64_t ) )
return - 1 ;
@ -1336,6 +1338,8 @@ static int mov_read_stsc(MOVContext *c, AVIOContext *pb, MOVAtom atom)
av_dlog ( c - > fc , " track[%i].stsc.entries = %i \n " , c - > fc - > nb_streams - 1 , entries ) ;
if ( ! entries )
return 0 ;
if ( entries > = UINT_MAX / sizeof ( * sc - > stsc_data ) )
return - 1 ;
sc - > stsc_data = av_malloc ( entries * sizeof ( * sc - > stsc_data ) ) ;
@ -1451,6 +1455,8 @@ static int mov_read_stsz(MOVContext *c, AVIOContext *pb, MOVAtom atom)
return - 1 ;
}
if ( ! entries )
return 0 ;
if ( entries > = UINT_MAX / sizeof ( int ) | | entries > = ( UINT_MAX - 4 ) / field_size )
return - 1 ;
sc - > sample_sizes = av_malloc ( entries * sizeof ( int ) ) ;
@ -1550,6 +1556,8 @@ static int mov_read_ctts(MOVContext *c, AVIOContext *pb, MOVAtom atom)
av_dlog ( c - > fc , " track[%i].ctts.entries = %i \n " , c - > fc - > nb_streams - 1 , entries ) ;
if ( ! entries )
return 0 ;
if ( entries > = UINT_MAX / sizeof ( * sc - > ctts_data ) )
return - 1 ;
sc - > ctts_data = av_malloc ( entries * sizeof ( * sc - > ctts_data ) ) ;
@ -1609,6 +1617,8 @@ static void mov_build_index(MOVContext *mov, AVStream *st)
current_dts - = sc - > dts_shift ;
if ( ! sc - > sample_count )
return ;
if ( sc - > sample_count > = UINT_MAX / sizeof ( * st - > index_entries ) )
return ;
st - > index_entries = av_malloc ( sc - > sample_count * sizeof ( * st - > index_entries ) ) ;