diff --git a/libavformat/mov.c b/libavformat/mov.c index 7dffa34bd8..eb12edf377 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -3288,6 +3288,9 @@ static int mov_read_sdtp(MOVContext *c, AVIOContext *pb, MOVAtom atom) av_freep(&sc->sdtp_data); sc->sdtp_count = 0; + if (entries < 0 || entries > SIZE_MAX) + return AVERROR(ERANGE); + sc->sdtp_data = av_malloc(entries); if (!sc->sdtp_data) return AVERROR(ENOMEM);