movenc: check that fps for tmcd is within encodable range.

The fps is stored as a 8 bit value thus 255 is the maximum encodable.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

libavformat/movenc.c

@@ -1149,6 +1149,11 @@ static int mov_write_tmcd_tag(AVIOContext *pb, MOVTrack *track)
     int frame_duration = av_rescale(track->timescale, track->enc->time_base.num, track->enc->time_base.den);
     int nb_frames = 1.0/av_q2d(track->enc->time_base) + 0.5;
 
+    if (nb_frames > 255) {
+        av_log(NULL, AV_LOG_ERROR, "fps %d is too large\n", nb_frames);
+        return AVERROR(EINVAL);
+    }
+
     avio_wb32(pb, 0); /* size */
     ffio_wfourcc(pb, "tmcd");               /* Data format */
     avio_wb32(pb, 0);                       /* Reserved */