Mercurial > libavformat.hg
comparison mov.c @ 6467:bae1afdd961a libavformat
Check dref size based on a patch by google
| author | bcoudurier |
|---|---|
| date | Wed, 08 Sep 2010 20:20:24 +0000 |
| parents | 35bb7cdfe337 |
| children | b7f807b4cd88 |
comparison
equal
deleted
inserted
replaced
| 6466:35bb7cdfe337 | 6467:bae1afdd961a |
|---|---|
| 342 | 342 |
| 343 for (i = 0; i < sc->drefs_count; i++) { | 343 for (i = 0; i < sc->drefs_count; i++) { |
| 344 MOVDref *dref = &sc->drefs[i]; | 344 MOVDref *dref = &sc->drefs[i]; |
| 345 uint32_t size = get_be32(pb); | 345 uint32_t size = get_be32(pb); |
| 346 int64_t next = url_ftell(pb) + size - 4; | 346 int64_t next = url_ftell(pb) + size - 4; |
| 347 | |
| 348 if (size < 12) | |
| 349 return -1; | |
| 347 | 350 |
| 348 dref->type = get_le32(pb); | 351 dref->type = get_le32(pb); |
| 349 get_be32(pb); // version + flags | 352 get_be32(pb); // version + flags |
| 350 dprintf(c->fc, "type %.4s size %d\n", (char*)&dref->type, size); | 353 dprintf(c->fc, "type %.4s size %d\n", (char*)&dref->type, size); |
| 351 | 354 |