# HG changeset patch
# User bcoudurier
# Date 1233702221 0
# Node ID 329080adea7978f59f3d9e93c49210dc8e3c1e2f
# Parent  f666f5481e531e34a56c2e2f69a25d40efd8d688
prevent reading more than container atom size, fix broken file broken_by_rev15830.MOV, fix #818

diff -r f666f5481e53 -r 329080adea79 mov.c
--- a/mov.c	Tue Feb 03 22:12:06 2009 +0000
+++ b/mov.c	Tue Feb 03 23:03:41 2009 +0000
@@ -1443,10 +1443,12 @@
             get_be32(pb); // type
             get_be32(pb); // unknown
             str_size = data_size - 16;
+            atom.size -= 16;
         } else return 0;
     } else {
         str_size = get_be16(pb); // string length
         get_be16(pb); // language
+        atom.size -= 4;
     }
     switch (atom.type) {
     case MKTAG(0xa9,'n','a','m'):
@@ -1464,8 +1466,11 @@
     }
     if (!str)
         return 0;
-    get_buffer(pb, str, FFMIN(size, str_size));
-    dprintf(c->fc, "%.4s %s\n", (char*)&atom.type, str);
+    if (atom.size < 0)
+        return -1;
+
+    get_buffer(pb, str, FFMIN3(size, str_size, atom.size));
+    dprintf(c->fc, "%.4s %s %d %lld\n", (char*)&atom.type, str, str_size, atom.size);
     return 0;
 }