Merge commit '90bc423212396e96a02edc1118982ab7f7766a63'

* commit '90bc423212396e96a02edc1118982ab7f7766a63':
  mov: Wrap stsc index and count compare in a separate function

The mov_stsc_index_valid() function is replaced with a macro to prevent
signdness issues (index is not always signed, and count is always
unsigned currently).

The comparison is also adjusted to reduce the risk of overflows.

Merged-by: Clément Bœsch <u@pkh.me>

diff --cc libavformat/mov.c
index da613bee73e3d0df6bc36a956f08d8de32974fa2,826be02abcb90056f0c6ac9e9fe14ed4a5af711a..6fd43a0a4e3b1550275e47280f980287a882c7cf
--- 1/libavformat/mov.c
--- 2/libavformat/mov.c
+++ b/libavformat/mov.c
@@@ -2432,6 -1961,11 +2432,8 @@@ static int mov_read_stsc(MOVContext *c
      return 0;
  }
  
 -static inline int mov_stsc_index_valid(int index, int count)
 -{
 -    return index + 1 < count;
 -}
++#define mov_stsc_index_valid(index, count) ((index) < (count) - 1)
+ 
  /* Compute the samples value for the stsc entry at the given index. */
  static inline int mov_get_stsc_samples(MOVStreamContext *sc, int index)
  {
@@@ -3351,22 -2337,10 +3353,22 @@@ static void mov_build_index(MOVContext 
          st->index_entries_allocated_size = (st->nb_index_entries + sc->sample_count) * sizeof(*st->index_entries);
  
          for (i = 0; i < sc->chunk_count; i++) {
 +            int64_t next_offset = i+1 < sc->chunk_count ? sc->chunk_offsets[i+1] : INT64_MAX;
              current_offset = sc->chunk_offsets[i];
-             while (stsc_index + 1 < sc->stsc_count &&
+             while (mov_stsc_index_valid(stsc_index, sc->stsc_count) &&
                  i + 1 == sc->stsc_data[stsc_index + 1].first)
                  stsc_index++;
 +
 +            if (next_offset > current_offset && sc->sample_size>0 && sc->sample_size < sc->stsz_sample_size &&
 +                sc->stsc_data[stsc_index].count * (int64_t)sc->stsz_sample_size > next_offset - current_offset) {
 +                av_log(mov->fc, AV_LOG_WARNING, "STSZ sample size %d invalid (too large), ignoring\n", sc->stsz_sample_size);
 +                sc->stsz_sample_size = sc->sample_size;
 +            }
 +            if (sc->stsz_sample_size>0 && sc->stsz_sample_size < sc->sample_size) {
 +                av_log(mov->fc, AV_LOG_WARNING, "STSZ sample size %d invalid (too small), ignoring\n", sc->stsz_sample_size);
 +                sc->stsz_sample_size = sc->sample_size;
 +            }
 +
              for (j = 0; j < sc->stsc_data[stsc_index].count; j++) {
                  int keyframe = 0;
                  if (current_sample >= sc->sample_count) {