avformat/mov: perform sanity checks for heif before index building

Fixes: undefined NULL pointer use
Fixes: clusterfuzz-testcase-minimized-audio_decoder_fuzzer-6363211175493632

This performs equivalent sanity checks as are done in mov_read_trak()
before mov_build_index()

Reported-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
master
Michael Niedermayer 2 months ago
parent 16b3d3e3eb
commit afbc3a1b23
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
  1. 3
      libavformat/mov.c

@ -10332,7 +10332,8 @@ static int mov_parse_heif_items(AVFormatContext *s)
st->codecpar->width = item->width;
st->codecpar->height = item->height;
if (sc->sample_count != 1 || sc->chunk_count != 1)
err = sanity_checks(s, sc, item->item_id);
if (err)
return AVERROR_INVALIDDATA;
sc->sample_sizes[0] = item->extent_length;

Loading…
Cancel
Save