---
libavformat/mov.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index fceef5b..385bd1d 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -1952,6 +1952,8 @@ static int mov_read_stsc(MOVContext *c, AVIOContext *pb,
MOVAtom atom)
sc->stsc_data[i].first = avio_rb32(pb);
sc->stsc_data[i].count = avio_rb32(pb);
sc->stsc_data[i].id = avio_rb32(pb);
+ if (sc->stsc_data[i].id > sc->stsd_count)
+ return AVERROR_INVALIDDATA;
}
sc->stsc_count = i;
--
2.8.3
_______________________________________________
libav-devel mailing list
libav-devel@libav.org
https://lists.libav.org/mailman/listinfo/libav-devel
