# HG changeset patch
# User reimar
# Date 1215813557 0
# Node ID 606f30477d1852815610b2256b5a741cce053fb8
# Parent  f80855a9d336586230a332e6a931eb60b8aa4875
Add atom_len sanity check to mov demuxer.
Fixes bug #1168

diff -r f80855a9d336 -r 606f30477d18 libmpdemux/demux_mov.c
--- a/libmpdemux/demux_mov.c	Fri Jul 11 20:22:07 2008 +0000
+++ b/libmpdemux/demux_mov.c	Fri Jul 11 21:59:17 2008 +0000
@@ -772,6 +772,7 @@
 		}
 		if (trak->stdata_len >= 36 + adjust) {
 		    int atom_len = char2int(trak->stdata,28+adjust);
+		    if (atom_len < 0 || atom_len > trak->stdata_len - 28 - adjust) atom_len = trak->stdata_len - 28 - adjust;
 		    switch(char2int(trak->stdata,32+adjust)) { // atom type
 		      case MOV_FOURCC('e','s','d','s'): {
 			mp_msg(MSGT_DEMUX, MSGL_V, "MOV: Found MPEG4 audio Elementary Stream Descriptor atom (%d)!\n", atom_len);