[SCM] libav/experimental: stop parsing udta if size is wrong/garbage, fix issue 154, fix RQ004F14.MOV
siretart at users.alioth.debian.org
siretart at users.alioth.debian.org
Sun Jun 30 16:07:05 UTC 2013
The following commit has been merged in the experimental branch:
commit aaac6c29d215dc4f36d7bec8e88466f83a234b5e
Author: Baptiste Coudurier <baptiste.coudurier at gmail.com>
Date: Wed Sep 12 10:18:01 2007 +0000
stop parsing udta if size is wrong/garbage, fix issue 154, fix RQ004F14.MOV
Originally committed as revision 10481 to svn://svn.ffmpeg.org/ffmpeg/trunk
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 68c81de..c9de693 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -1060,6 +1060,9 @@ static int mov_read_udta(MOVContext *c, ByteIOContext *pb, MOV_atom_t atom)
uint32_t tag = get_le32(pb);
uint64_t next = url_ftell(pb) + tag_size - 8;
+ if (next > end) // stop if tag_size is wrong
+ break;
+
switch (tag) {
case MKTAG(0xa9,'n','a','m'):
mov_parse_udta_string(pb, c->fc->title, sizeof(c->fc->title));
--
Libav/FFmpeg packaging
More information about the pkg-multimedia-commits
mailing list