Commit 3ebd76a9 authored by Dale Curtis's avatar Dale Curtis Committed by Michael Niedermayer

mov: Fix negative size calculation in mov_read_default().

The previous code assumed if an atom was marked with a 64-bit
size extension, it actually had that data available. The new
code verfies there's enough data in the atom for this to be
done.

Failure to verify causes total_size > atom.size which will
result in negative size calculations later on.
Found-by: 's avatarPaul Mehta <paul@paulmehta.com>
Signed-off-by: 's avatarDale Curtis <dalecurtis@chromium.org>
Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parent 3859868c
......@@ -3471,7 +3471,7 @@ static int mov_read_default(MOVContext *c, AVIOContext *pb, MOVAtom atom)
}
}
total_size += 8;
if (a.size == 1) { /* 64 bit extended size */
if (a.size == 1 && total_size + 8 <= atom.size) { /* 64 bit extended size */
a.size = avio_rb64(pb) - 8;
total_size += 8;
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment