Commit aaac6c29 authored by Baptiste Coudurier's avatar Baptiste Coudurier

stop parsing udta if size is wrong/garbage, fix issue 154, fix RQ004F14.MOV

Originally committed as revision 10481 to svn://svn.ffmpeg.org/ffmpeg/trunk
parent 36cb992b
...@@ -1060,6 +1060,9 @@ static int mov_read_udta(MOVContext *c, ByteIOContext *pb, MOV_atom_t atom) ...@@ -1060,6 +1060,9 @@ static int mov_read_udta(MOVContext *c, ByteIOContext *pb, MOV_atom_t atom)
uint32_t tag = get_le32(pb); uint32_t tag = get_le32(pb);
uint64_t next = url_ftell(pb) + tag_size - 8; uint64_t next = url_ftell(pb) + tag_size - 8;
if (next > end) // stop if tag_size is wrong
break;
switch (tag) { switch (tag) {
case MKTAG(0xa9,'n','a','m'): case MKTAG(0xa9,'n','a','m'):
mov_parse_udta_string(pb, c->fc->title, sizeof(c->fc->title)); mov_parse_udta_string(pb, c->fc->title, sizeof(c->fc->title));
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment