comparison mov.c @ 1962:f28d346de931 libavformat

break if atom size is more than size left in container atom, fix shooter.mov
author bcoudurier
date Thu, 29 Mar 2007 10:37:07 +0000
parents edfd6b33d1f6
children 81268e2bd9aa
comparison
equal deleted inserted replaced
1961:0bb1bfbaa031 1962:f28d346de931
248 && c->parse_table[i].type != a.type; i++) 248 && c->parse_table[i].type != a.type; i++)
249 /* empty */; 249 /* empty */;
250 250
251 a.size -= 8; 251 a.size -= 8;
252 252
253 if(a.size < 0) 253 if(a.size < 0 || a.size > atom.size - total_size)
254 break; 254 break;
255 255
256 if (c->parse_table[i].type == 0) { /* skip leaf atoms data */ 256 if (c->parse_table[i].type == 0) { /* skip leaf atoms data */
257 url_fskip(pb, a.size); 257 url_fskip(pb, a.size);
258 } else { 258 } else {