X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavformat%2Fmvdec.c;h=64166a84b1f90c695528b7d8ac9f4c624e6e977f;hb=c5324d92c5f206dcdc2cf93ae237eaa7c1ad0a40;hp=fa596179ed97ab8fd25d07bacaee0ad4a98153b4;hpb=a12063b118ad05409ff775ba30fab00265ad3031;p=ffmpeg

diff --git a/libavformat/mvdec.c b/libavformat/mvdec.c
index fa596179ed9..64166a84b1f 100644
--- a/libavformat/mvdec.c
+++ b/libavformat/mvdec.c
@@ -46,7 +46,7 @@ typedef struct MvContext {
 
 #define AUDIO_FORMAT_SIGNED 401
 
-static int mv_probe(AVProbeData *p)
+static int mv_probe(const AVProbeData *p)
 {
     if (AV_RB32(p->buf) == MKBETAG('M', 'O', 'V', 'I') &&
         AV_RB16(p->buf + 4) < 3)
@@ -211,6 +211,8 @@ static int parse_video_var(AVFormatContext *avctx, AVStream *st,
     } else if (!strcmp(name, "ORIENTATION")) {
         if (var_read_int(pb, size) == 1101) {
             st->codecpar->extradata      = av_strdup("BottomUp");
+            if (!st->codecpar->extradata)
+                return AVERROR(ENOMEM);
             st->codecpar->extradata_size = 9;
         }
     } else if (!strcmp(name, "Q_SPATIAL") || !strcmp(name, "Q_TEMPORAL")) {
@@ -361,6 +363,12 @@ static int mv_read_header(AVFormatContext *avctx)
         if ((ret = read_table(avctx, NULL, parse_global_var)) < 0)
             return ret;
 
+        if (mv->nb_audio_tracks < 0  || mv->nb_video_tracks < 0 ||
+           (mv->nb_audio_tracks == 0 && mv->nb_video_tracks == 0)) {
+            av_log(avctx, AV_LOG_ERROR, "Stream count is invalid.\n");
+            return AVERROR_INVALIDDATA;
+        }
+
         if (mv->nb_audio_tracks > 1) {
             avpriv_request_sample(avctx, "Multiple audio streams support");
             return AVERROR_PATCHWELCOME;