Browse Source

break if atom size is more than size left in container atom, fix shooter.mov

Originally committed as revision 8544 to svn://svn.ffmpeg.org/ffmpeg/trunk
tags/v0.5
Baptiste Coudurier 18 years ago
parent
commit
62b6498df2
1 changed files with 1 additions and 1 deletions
  1. +1
    -1
      libavformat/mov.c

+ 1
- 1
libavformat/mov.c View File

@@ -250,7 +250,7 @@ static int mov_read_default(MOVContext *c, ByteIOContext *pb, MOV_atom_t atom)

a.size -= 8;

if(a.size < 0)
if(a.size < 0 || a.size > atom.size - total_size)
break;

if (c->parse_table[i].type == 0) { /* skip leaf atoms data */


Loading…
Cancel
Save