Mercurial > mplayer.hg
changeset 27232:606f30477d18
Add atom_len sanity check to mov demuxer.
Fixes bug #1168
| author | reimar |
|---|---|
| date | Fri, 11 Jul 2008 21:59:17 +0000 |
| parents | f80855a9d336 |
| children | 8c5ec96a0bc7 |
| files | libmpdemux/demux_mov.c |
| diffstat | 1 files changed, 1 insertions(+), 0 deletions(-) [+] |
line wrap: on
line diff
--- a/libmpdemux/demux_mov.c Fri Jul 11 20:22:07 2008 +0000 +++ b/libmpdemux/demux_mov.c Fri Jul 11 21:59:17 2008 +0000 @@ -772,6 +772,7 @@ } if (trak->stdata_len >= 36 + adjust) { int atom_len = char2int(trak->stdata,28+adjust); + if (atom_len < 0 || atom_len > trak->stdata_len - 28 - adjust) atom_len = trak->stdata_len - 28 - adjust; switch(char2int(trak->stdata,32+adjust)) { // atom type case MOV_FOURCC('e','s','d','s'): { mp_msg(MSGT_DEMUX, MSGL_V, "MOV: Found MPEG4 audio Elementary Stream Descriptor atom (%d)!\n", atom_len);