diff --git a/libavformat/mov.c b/libavformat/mov.c index 7d00334fae..12fb00be59 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -9217,6 +9217,13 @@ static int mov_read_iref_dimg(MOVContext *c, AVIOContext *pb, int version) return AVERROR_INVALIDDATA; } + entries = avio_rb16(pb); + if (!entries) { + av_log(c->fc, AV_LOG_ERROR, + "Derived image item references no input images\n"); + return AVERROR_INVALIDDATA; + } + grid = av_realloc_array(c->heif_grid, c->nb_heif_grid + 1U, sizeof(*c->heif_grid)); if (!grid) @@ -9224,7 +9231,6 @@ static int mov_read_iref_dimg(MOVContext *c, AVIOContext *pb, int version) c->heif_grid = grid; grid = &grid[c->nb_heif_grid]; - entries = avio_rb16(pb); grid->tile_id_list = av_malloc_array(entries, sizeof(*grid->tile_id_list)); grid->tile_idx_list = av_calloc(entries, sizeof(*grid->tile_idx_list)); grid->tile_item_list = av_calloc(entries, sizeof(*grid->tile_item_list));