[FFmpeg-devel] [PATCH 2/4] mov: check for positive sample->size

[Andreas Cadhalpun]

On 24.05.2015 19:23, Michael Niedermayer wrote:
> On Sun, May 24, 2015 at 03:21:25PM +0200, Andreas Cadhalpun wrote:
>>  mov.c |    5 +++++
>>  1 file changed, 5 insertions(+)
>> 199a14800f0d79aa85b8dc01c2c1dc2743c3fb0d  0001-mov-check-for-negative-stsc-count.patch
>> From 1d66ce9f96ccd4e130837a5e38885109f26bb4f6 Mon Sep 17 00:00:00 2001
>> From: Andreas Cadhalpun <Andreas.Cadhalpun at googlemail.com>
>> Date: Sun, 24 May 2015 15:14:23 +0200
>> Subject: [PATCH] mov: check for negative stsc count
>>
>> A negative stsc count can cause the mov demuxer to return a large
>> number of empty packets.
> 
> ISO/IEC 14496-12:2012(E) says the field is unsigned so it cannot be
> negative
> 
> 8.7.4.2   Syntax
> aligned(8) class SampleToChunkBox
>     extends FullBox("stsc", version = 0, 0) {
>     unsigned int(32) entry_count;
>     for (i=1; i <= entry_count; i++) {
>         unsigned int(32) first_chunk;
>         unsigned int(32) samples_per_chunk;
>         unsigned int(32) sample_description_index;
>     }
> }

OK, but then the types of the members of MOVStsc and likely also MOVStts
are incorrectly int. The first attached patch changes that.

The second patch is another attempt at fixing the original problem.
Surely zero bytes_per_frame with non-zero samples_per_frame must be invalid,
or is it also allowed by the spec?

Best regards,
Andreas
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-isom-use-uint32_t-instead-of-int-for-members-of-MOVS.patch
Type: text/x-diff
Size: 1021 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20150525/b8ef8586/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-mov-reject-zero-bytes_per_frame-with-non-zero-sample.patch
Type: text/x-diff
Size: 1237 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20150525/b8ef8586/attachment-0001.bin>