changeset 27231:f80855a9d336

Quick hack to fix demux_mov crashes where easily possible.

--- a/libmpdemux/demux_mov.c	Fri Jul 11 19:29:41 2008 +0000
+++ b/libmpdemux/demux_mov.c	Fri Jul 11 20:22:07 2008 +0000
@@ -205,9 +205,9 @@
 
     // workaround for fixed-size video frames (dv and uncompressed)
     if(!trak->samples_size && trak->type!=MOV_TRAK_AUDIO){
-	trak->samples_size=s;
 	trak->samples=calloc(s, sizeof(mov_sample_t));
-	for(i=0;i<s;i++)
+	trak->samples_size=trak->samples ? s : 0;
+	for(i=0;i<trak->samples_size;i++)
 	    trak->samples[i].size=trak->samplesize;
 	trak->samplesize=0;
     }
@@ -224,8 +224,8 @@
       mp_msg(MSGT_DEMUX, MSGL_WARN,
              "MOV: durmap or chunkmap bigger than sample count (%i vs %i)\n",
              s, trak->samples_size);
-      trak->samples_size = s;
       trak->samples = realloc_struct(trak->samples, s, sizeof(mov_sample_t));
+      trak->samples_size = trak->samples ? s : 0;
     }
 
     // calc pts:
@@ -1748,8 +1748,8 @@
              "MOV: %*sSample duration table! (%d blocks)\n", level, "",
              len);
       trak->durmap = calloc(len, sizeof(mov_durmap_t));
-      trak->durmap_size = len;
-      for (i = 0; i < len; i++) {
+      trak->durmap_size = trak->durmap ? 0 : len;
+      for (i = 0; i < trak->durmap_size; i++) {
         trak->durmap[i].num = stream_read_dword(demuxer->stream);
         trak->durmap[i].dur = stream_read_dword(demuxer->stream);
         pts += trak->durmap[i].num * trak->durmap[i].dur;
@@ -1769,9 +1769,9 @@
              "MOV: %*sSample->Chunk mapping table!  (%d blocks) (ver:%d,flags:%d)\n", level, "",
              len, ver, flags);
       // read data:
-      trak->chunkmap_size = len;
       trak->chunkmap = calloc(len, sizeof(mov_chunkmap_t));
-      for (i = 0; i < len; i++) {
+      trak->chunkmap_size = trak->chunkmap ? len : 0;
+      for (i = 0; i < trak->chunkmap_size; i++) {
         trak->chunkmap[i].first = stream_read_dword(demuxer->stream) - 1;
         trak->chunkmap[i].spc = stream_read_dword(demuxer->stream);
         trak->chunkmap[i].sdid = stream_read_dword(demuxer->stream);
@@ -1793,7 +1793,7 @@
         // variable samplesize
         trak->samples = realloc_struct(trak->samples, entries, sizeof(mov_sample_t));
         trak->samples_size = entries;
-        for (i = 0; i < entries; i++)
+        for (i = 0; i < trak->samples_size; i++)
           trak->samples[i].size = stream_read_dword(demuxer->stream);
       }
       break;
@@ -1808,10 +1808,10 @@
       // extend array if needed:
       if (len > trak->chunks_size) {
         trak->chunks = realloc_struct(trak->chunks, len, sizeof(mov_chunk_t));
-        trak->chunks_size = len;
+        trak->chunks_size = trak->chunks ? len : 0;
       }
       // read elements:
-      for(i = 0; i < len; i++)
+      for(i = 0; i < trak->chunks_size; i++)
         trak->chunks[i].pos = stream_read_dword(demuxer->stream);
       break;
     }
@@ -1825,10 +1825,10 @@
       // extend array if needed:
       if (len > trak->chunks_size) {
         trak->chunks = realloc_struct(trak->chunks, len, sizeof(mov_chunk_t));
-        trak->chunks_size = len;
+        trak->chunks_size = trak->chunks ? len : 0;
       }
       // read elements:
-      for (i = 0; i < len; i++) {
+      for (i = 0; i < trak->chunks_size; i++) {
 #ifndef	_LARGEFILE_SOURCE
         if (stream_read_dword(demuxer->stream) != 0)
           mp_msg(MSGT_DEMUX, MSGL_WARN, "Chunk %d has got 64bit address, but you've MPlayer compiled without LARGEFILE support!\n", i);
@@ -1848,9 +1848,9 @@
       mp_msg(MSGT_DEMUX, MSGL_V,
              "MOV: %*sSyncing samples (keyframes) table! (%d entries) (ver:%d,flags:%d)\n", level, "",
              entries, ver, flags);
-      trak->keyframes_size = entries;
       trak->keyframes = calloc(entries, sizeof(unsigned int));
-      for (i = 0; i < entries; i++)
+      trak->keyframes_size = trak->keyframes ? entries : 0;
+      for (i = 0; i < trak->keyframes_size; i++)
         trak->keyframes[i] = stream_read_dword(demuxer->stream) - 1;
       break;
     }
@@ -1884,9 +1884,9 @@
              "MOV: %*sEdit list table (%d entries) (ver:%d,flags:%d)\n", level, "",
              entries, ver, flags);
 #if 1
-      trak->editlist_size = entries;
       trak->editlist = calloc(trak->editlist_size, sizeof(mov_editlist_t));
-      for (i = 0; i < entries; i++) {
+      trak->editlist_size = trak->editlist ? entries : 0;
+      for (i = 0; i < trak->editlist_size; i++) {
         int dur = stream_read_dword(demuxer->stream);
         int mt = stream_read_dword(demuxer->stream);
         int mr = stream_read_dword(demuxer->stream); // 16.16fp