|
@@ -471,10 +471,6 @@ static int mov_text_decode_frame(AVCodecContext *avctx, |
|
|
tsmb_type = AV_RB32(tsmb); |
|
|
tsmb_type = AV_RB32(tsmb); |
|
|
tsmb += 4; |
|
|
tsmb += 4; |
|
|
|
|
|
|
|
|
if (tsmb_size == 0) { |
|
|
|
|
|
return AVERROR_INVALIDDATA; |
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
if (tsmb_size == 1) { |
|
|
if (tsmb_size == 1) { |
|
|
if (m->tracksize + 16 > avpkt->size) |
|
|
if (m->tracksize + 16 > avpkt->size) |
|
|
break; |
|
|
break; |
|
@@ -485,6 +481,10 @@ static int mov_text_decode_frame(AVCodecContext *avctx, |
|
|
m->size_var = 8; |
|
|
m->size_var = 8; |
|
|
//size_var is equal to 8 or 16 depending on the size of box |
|
|
//size_var is equal to 8 or 16 depending on the size of box |
|
|
|
|
|
|
|
|
|
|
|
if (tsmb_size == 0) { |
|
|
|
|
|
return AVERROR_INVALIDDATA; |
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
if (tsmb_size > avpkt->size - m->tracksize) |
|
|
if (tsmb_size > avpkt->size - m->tracksize) |
|
|
break; |
|
|
break; |
|
|
|
|
|
|
|
|