check entries against field_size, potential malloc overflow in read_stsz, fix #1357

Originally committed as revision 19793 to svn://svn.ffmpeg.org/ffmpeg/trunk

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 5f11ebe..05fdfa3 100644 (file)
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -1256,7 +1256,7 @@ static int mov_read_stsz(MOVContext *c, ByteIOContext *pb, MOVAtom atom)
         return -1;
     }
 
-    if(entries >= UINT_MAX / sizeof(int))
+    if (entries >= UINT_MAX / sizeof(int) || entries >= (UINT_MAX - 4) / field_size)
         return -1;
     sc->sample_sizes = av_malloc(entries * sizeof(int));
     if (!sc->sample_sizes)