diff --git a/libavformat/mov.c b/libavformat/mov.c index 672a218bb0..272ef7b503 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -2335,7 +2335,8 @@ static int mov_read_stsd(MOVContext *c, AVIOContext *pb, MOVAtom atom) avio_rb24(pb); /* flags */ entries = avio_rb32(pb); /* entries */ - if (entries <= 0) { + /* Each entry contains a size (4 bytes) and format (4 bytes). */ + if (entries <= 0 || entries > atom.size / 8) { av_log(c->fc, AV_LOG_ERROR, "invalid STSD entries %d\n", entries); return AVERROR_INVALIDDATA; }