mxfdec: Make sure x < index_table->nb_ptses

[ffmpeg] / libavformat / mxfdec.c

diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
index 3a0962429c7d6caec410fbd1e307fb8e998360ef..ea1129388e0347150cbcf277dac4e12278469848 100644 (file)
--- a/libavformat/mxfdec.c
+++ b/libavformat/mxfdec.c
@@ -1072,14 +1072,25 @@ static int mxf_compute_ptses_fake_index(MXFContext *mxf, MXFIndexTable *index_ta
     for (i = x = 0; i < index_table->nb_segments; i++) {
         MXFIndexTableSegment *s = index_table->segments[i];
         int index_delta = 1;
+        int n = s->nb_index_entries;
 
-        if (s->nb_index_entries == 2 * s->index_duration + 1)
+        if (s->nb_index_entries == 2 * s->index_duration + 1) {
             index_delta = 2;    /* Avid index */
 
-        for (j = 0; j < s->nb_index_entries; j += index_delta, x++) {
+            /* ignore the last entry - it's the size of the essence container */
+            n--;
+        }
+
+        for (j = 0; j < n; j += index_delta, x++) {
             int offset = s->temporal_offset_entries[j] / index_delta;
             int index  = x + offset;
 
+            if (x >= index_table->nb_ptses) {
+                av_log(mxf->fc, AV_LOG_ERROR, "x >= nb_ptses - IndexEntryCount %i < IndexDuration %"PRId64"?\n",
+                       s->nb_index_entries, s->index_duration);
+                break;
+            }
+
             index_table->fake_index[x].timestamp = x;
             index_table->fake_index[x].flags = !(s->flag_entries[j] & 0x30) ? AVINDEX_KEYFRAME : 0;