Hi, When parsing infe version > 2, mov_read_infe() reads item_id as 32-bit, so the fixed fields after the fullbox header consume 10 bytes instead of 8.
The current code still subtracts 8 from the remaining atom size. As a result, the parsed item_name can consume 2 bytes past the end of the infe box and into the following data in the iinf container. The patch below adjusts the size accounting for version > 2. Signed-off-by: João Neves <[email protected]> --- libavformat/mov.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index dc9233b8a8..ada633b14f 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -9068,7 +9068,7 @@ static int mov_read_infe(MOVContext *c, AVIOContext *pb, MOVAtom atom) item_id = version > 2 ? avio_rb32(pb) : avio_rb16(pb); avio_rb16(pb); // item_protection_index item_type = avio_rl32(pb); - size -= 8; + size -= version > 2 ? 10 : 8; if (size < 1) return AVERROR_INVALIDDATA; Regards, João _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
