From 869e44fdcccf86a4b9b496ca95bdb02b99732383 Mon Sep 17 00:00:00 2001
From: reimar <reimar@b3059339-0415-0410-9bf9-f77b7e298cf2>
Date: Fri, 4 Jul 2008 15:47:31 +0000
Subject: Check stdata_len before accessing stdata. Fixes bug #1125

git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@27194 b3059339-0415-0410-9bf9-f77b7e298cf2
---
 libmpdemux/demux_mov.c | 4 ++++
 1 file changed, 4 insertions(+)

(limited to 'libmpdemux')

diff --git a/libmpdemux/demux_mov.c b/libmpdemux/demux_mov.c
index e7e3551c32..1f5048345a 100644
--- a/libmpdemux/demux_mov.c
+++ b/libmpdemux/demux_mov.c
@@ -657,6 +657,10 @@ static int gen_sh_audio(sh_audio_t* sh, mov_track_t* trak, int timescale) {
 //      36  char[]  	atom data (len=size-8)
 
 // TODO: fix parsing for files using version 2.
+		if (trak->stdata_len < 26) {
+		  mp_msg(MSGT_DEMUX, MSGL_WARN, "MOV: broken (too small) sound atom!\n");
+		  return 0;
+		}
 		version=char2short(trak->stdata,8);
 		if (version > 1)
 		  mp_msg(MSGT_DEMUX, MSGL_WARN, "MOV: version %d sound atom may not parse correctly!\n", version);
-- 
cgit v1.2.3