[FFmpeg-devel] [PATCH] avformat/mov: abort reading truncated stts

[Gyan Doshi]

Avoids overreading the box and ingesting absurd values into stts_data
---

Fixes prolonged demuxing for fuzzer-generated files in the loop added in
patch for max_stts_delta

 libavformat/mov.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 2aed6e80ef..8d88119b29 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -2935,6 +2935,11 @@ static int mov_read_stts(MOVContext *c, AVIOContext *pb, MOVAtom atom)
     avio_rb24(pb); /* flags */
     entries = avio_rb32(pb);
 
+    if (atom.size < 8 + entries*8) {
+        av_log(c->fc, AV_LOG_ERROR, "Truncated STTS box for st %d.\n", c->fc->nb_streams-1);
+        return AVERROR_INVALIDDATA;
+    }
+
     av_log(c->fc, AV_LOG_TRACE, "track[%u].stts.entries = %u\n",
             c->fc->nb_streams-1, entries);
 
-- 
2.33.0