diff options
| author | reimar <reimar@b3059339-0415-0410-9bf9-f77b7e298cf2> | 2008-07-04 15:47:31 +0000 |
|---|---|---|
| committer | reimar <reimar@b3059339-0415-0410-9bf9-f77b7e298cf2> | 2008-07-04 15:47:31 +0000 |
| commit | 869e44fdcccf86a4b9b496ca95bdb02b99732383 (patch) | |
| tree | 6e50ff1c2d0c97e2adba35ec457d3ad230f67822 /libmpdemux | |
| parent | 3a9b304974d0a2952e8a0974404b00884c2720e9 (diff) | |
| download | mpv-869e44fdcccf86a4b9b496ca95bdb02b99732383.tar.bz2 mpv-869e44fdcccf86a4b9b496ca95bdb02b99732383.tar.xz | |
Check stdata_len before accessing stdata. Fixes bug #1125
git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@27194 b3059339-0415-0410-9bf9-f77b7e298cf2
Diffstat (limited to 'libmpdemux')
| -rw-r--r-- | libmpdemux/demux_mov.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libmpdemux/demux_mov.c b/libmpdemux/demux_mov.c index e7e3551c32..1f5048345a 100644 --- a/libmpdemux/demux_mov.c +++ b/libmpdemux/demux_mov.c @@ -657,6 +657,10 @@ static int gen_sh_audio(sh_audio_t* sh, mov_track_t* trak, int timescale) { // 36 char[] atom data (len=size-8) // TODO: fix parsing for files using version 2. + if (trak->stdata_len < 26) { + mp_msg(MSGT_DEMUX, MSGL_WARN, "MOV: broken (too small) sound atom!\n"); + return 0; + } version=char2short(trak->stdata,8); if (version > 1) mp_msg(MSGT_DEMUX, MSGL_WARN, "MOV: version %d sound atom may not parse correctly!\n", version); |