Mercurial > libavformat.hg

changeset 4369:329080adea79 libavformat

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
prevent reading more than container atom size, fix broken file broken_by_rev15830.MOV, fix #818
author bcoudurier
date Tue, 03 Feb 2009 23:03:41 +0000
parents f666f5481e53
children 6c34e8045dc7
files mov.c
diffstat 1 files changed, 7 insertions(+), 2 deletions(-) [+]
line wrap: on
line diff
--- a/mov.c	Tue Feb 03 22:12:06 2009 +0000
+++ b/mov.c	Tue Feb 03 23:03:41 2009 +0000
@@ -1443,10 +1443,12 @@
             get_be32(pb); // type
             get_be32(pb); // unknown
             str_size = data_size - 16;
+            atom.size -= 16;
         } else return 0;
     } else {
         str_size = get_be16(pb); // string length
         get_be16(pb); // language
+        atom.size -= 4;
     }
     switch (atom.type) {
     case MKTAG(0xa9,'n','a','m'):
@@ -1464,8 +1466,11 @@
     }
     if (!str)
         return 0;
-    get_buffer(pb, str, FFMIN(size, str_size));
-    dprintf(c->fc, "%.4s %s\n", (char*)&atom.type, str);
+    if (atom.size < 0)
+        return -1;
+
+    get_buffer(pb, str, FFMIN3(size, str_size, atom.size));
+    dprintf(c->fc, "%.4s %s %d %lld\n", (char*)&atom.type, str, str_size, atom.size);
     return 0;
 }