From c1f2df8f53deced39e181ce8e6ef6aaa41256781 Mon Sep 17 00:00:00 2001 From: reimar Date: Tue, 30 Aug 2005 23:24:47 +0000 Subject: extra size checks for samples array to avoid crashes in some rare cases. git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@16321 b3059339-0415-0410-9bf9-f77b7e298cf2 --- libmpdemux/demux_mov.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) (limited to 'libmpdemux') diff --git a/libmpdemux/demux_mov.c b/libmpdemux/demux_mov.c index f2c2993037..7ab60ea315 100644 --- a/libmpdemux/demux_mov.c +++ b/libmpdemux/demux_mov.c @@ -194,6 +194,14 @@ void mov_build_index(mov_track_t* trak,int timescale){ trak->chunks[j].sample=s; s+=trak->chunks[j].size; } + i = 0; + for (j = 0; j < trak->durmap_size; j++) + i += trak->durmap[j].num; + if (i != s) { + mp_msg(MSGT_DEMUX, MSGL_WARN, + "MOV: durmap and chunkmap sample count differ (%i vs %i)\n", i, s); + if (i > s) s = i; + } // workaround for fixed-size video frames (dv and uncompressed) if(!trak->samples_size && trak->type!=MOV_TRAK_AUDIO){ @@ -212,6 +220,14 @@ void mov_build_index(mov_track_t* trak,int timescale){ return; } + if (trak->samples_size < s) { + mp_msg(MSGT_DEMUX, MSGL_WARN, + "MOV: durmap or chunkmap bigger than sample count (%i vs %i)\n", + s, trak->samples_size); + trak->samples_size = s; + trak->samples = realloc(trak->samples, sizeof(mov_sample_t) * s); + } + // calc pts: s=0; for(j=0;jdurmap_size;j++){ -- cgit v1.2.3