From: Aaron Colwell <acolwell@google.com>
Date: Fri, 27 Jan 2017 17:33:29 +0000 (-0800)
Subject: mov: Fix spherical metadata_source parsing
X-Git-Tag: android-x86-7.1-r1~2324
X-Git-Url: http://git.osdn.net/view?a=commitdiff_plain;h=b9f2f93261548f7cfdfc7a4040b23baed11e5554;p=android-x86%2Fexternal-ffmpeg.git

mov: Fix spherical metadata_source parsing

Signed-off-by: James Almer <jamrial@gmail.com>
---

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 7dc550eb99..b1bfa0a35f 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -4566,7 +4566,7 @@ static int mov_read_sv3d(MOVContext *c, AVIOContext *pb, MOVAtom atom)
     }
 
     size = avio_rb32(pb);
-    if (size > atom.size)
+    if (size <= 12 || size > atom.size)
         return AVERROR_INVALIDDATA;
 
     tag = avio_rl32(pb);
@@ -4575,7 +4575,7 @@ static int mov_read_sv3d(MOVContext *c, AVIOContext *pb, MOVAtom atom)
         return 0;
     }
     avio_skip(pb, 4); /*  version + flags */
-    avio_skip(pb, avio_r8(pb)); /* metadata_source */
+    avio_skip(pb, size - 12); /* metadata_source */
 
     size = avio_rb32(pb);
     if (size > atom.size)