# HG changeset patch
# User reimar
# Date 1125444287 0
# Node ID 2b6430db786ad5744233068ec78d89194b2086f5
# Parent  798d9be2337f9498e4bd6c89ea607f16ea9cc8b9
extra size checks for samples array to avoid crashes in some rare cases.

diff -r 798d9be2337f -r 2b6430db786a libmpdemux/demux_mov.c
--- a/libmpdemux/demux_mov.c	Tue Aug 30 22:07:30 2005 +0000
+++ b/libmpdemux/demux_mov.c	Tue Aug 30 23:24:47 2005 +0000
@@ -194,6 +194,14 @@
         trak->chunks[j].sample=s;
         s+=trak->chunks[j].size;
     }
+    i = 0;
+    for (j = 0; j < trak->durmap_size; j++)
+      i += trak->durmap[j].num;
+    if (i != s) {
+      mp_msg(MSGT_DEMUX, MSGL_WARN,
+             "MOV: durmap and chunkmap sample count differ (%i vs %i)\n", i, s);
+      if (i > s) s = i;
+    }
 
     // workaround for fixed-size video frames (dv and uncompressed)
     if(!trak->samples_size && trak->type!=MOV_TRAK_AUDIO){
@@ -212,6 +220,14 @@
 	return;
     }
     
+    if (trak->samples_size < s) {
+      mp_msg(MSGT_DEMUX, MSGL_WARN,
+             "MOV: durmap or chunkmap bigger than sample count (%i vs %i)\n",
+             s, trak->samples_size);
+      trak->samples_size = s;
+      trak->samples = realloc(trak->samples, sizeof(mov_sample_t) * s);
+    }
+
     // calc pts:
     s=0;
     for(j=0;j<trak->durmap_size;j++){