avio_r8(pb); /* version */
avio_rb24(pb); /* flags */
- entries = avio_rb32(pb); /* entries */
+ entries = avio_rb32(pb);
+ if (entries <= 0) {
+ av_log(c->fc, AV_LOG_ERROR, "invalid STSD entries %d\n", entries);
+ return AVERROR_INVALIDDATA;
+ }
+
+ if (sc->extradata) {
+ av_log(c->fc, AV_LOG_ERROR, "Duplicate STSD\n");
+ return AVERROR_INVALIDDATA;
+ }
/* Prepare space for hosting multiple extradata. */
sc->extradata = av_mallocz_array(entries, sizeof(*sc->extradata));
- if (!sc->extradata)
- return AVERROR(ENOMEM);
-
- sc->stsd_count = entries;
- sc->extradata_size = av_mallocz_array(sc->stsd_count, sizeof(sc->extradata_size));
- if (!sc->extradata_size)
- return AVERROR(ENOMEM);
+ sc->extradata_size = av_mallocz_array(entries, sizeof(*sc->extradata_size));
+ if (!sc->extradata_size || !sc->extradata) {
+ ret = AVERROR(ENOMEM);
+ goto fail;
+ }
- ret = ff_mov_read_stsd_entries(c, pb, sc->stsd_count);
+ ret = ff_mov_read_stsd_entries(c, pb, entries);
if (ret < 0)
return ret;