Merge commit 'e2ce16392205d8efe9143329ed3fb5fcb15498fa'

[ffmpeg] / libavformat / mov.c

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 2ce6f9c664b36be19a06129b2fb701fca37adcde..4cfeb36dc61c26ee98d71bb22c323117f4d768fd 100644 (file)
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -1972,7 +1972,9 @@ static int mov_read_stss(MOVContext *c, AVIOContext *pb, MOVAtom atom)
     }
     if (sc->keyframes)
         av_log(c->fc, AV_LOG_WARNING, "Duplicated STSS atom\n");
-    av_free(sc->keyframes);
+    if (entries >= UINT_MAX / sizeof(int))
+        return AVERROR_INVALIDDATA;
+    av_freep(&sc->keyframes);
     sc->keyframe_count = 0;
     sc->keyframes = av_malloc_array(entries, sizeof(*sc->keyframes));
     if (!sc->keyframes)