[FFmpeg-devel] [PATCH] avformat/mov: further ensure mov_build_index isn't run twice

[James Almer]

If sc->tts_count is not 0, then the sample index has already been built.

Fixes: Null-dereference READ
Fixes: 396192874/clusterfuzz-testcase-minimized-audio_decoder_fuzzer-4589309789143040

Signed-off-by: James Almer <jamrial at gmail.com>
---
Supersedes "avformat/mov: ensure no trun atoms are parsed as children of trak"

 libavformat/mov.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 85aef33b19..1c4b13864e 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -4688,7 +4688,7 @@ static void mov_build_index(MOVContext *mov, AVStream *st)
 
     /* only use old uncompressed audio chunk demuxing when stts specifies it */
     if (!(st->codecpar->codec_type == AVMEDIA_TYPE_AUDIO &&
-          sc->stts_count == 1 && sc->stts_data[0].duration == 1)) {
+          sc->stts_count == 1 && sc->stts_data && sc->stts_data[0].duration == 1)) {
         unsigned int current_sample = 0;
         unsigned int stts_sample = 0;
         unsigned int sample_size;
@@ -4700,7 +4700,7 @@ static void mov_build_index(MOVContext *mov, AVStream *st)
 
         current_dts -= sc->dts_shift;
 
-        if (!sc->sample_count || sti->nb_index_entries)
+        if (!sc->sample_count || sti->nb_index_entries || sc->tts_count)
             return;
         if (sc->sample_count >= UINT_MAX / sizeof(*sti->index_entries) - sti->nb_index_entries)
             return;
@@ -4811,11 +4811,11 @@ static void mov_build_index(MOVContext *mov, AVStream *st)
     } else {
         unsigned chunk_samples, total = 0;
 
-        ret = mov_merge_tts_data(mov, st, MOV_MERGE_CTTS);
-        if (ret < 0)
+        if (!sc->chunk_count || sc->tts_count)
             return;
 
-        if (!sc->chunk_count)
+        ret = mov_merge_tts_data(mov, st, MOV_MERGE_CTTS);
+        if (ret < 0)
             return;
 
         // compute total chunk count
-- 
2.48.1