diff options
| author | Matthias Hopf <mhopf@suse.de> | 2009-01-01 01:58:17 +0100 |
|---|---|---|
| committer | Matthias Hopf <mhopf@suse.de> | 2009-01-01 01:58:17 +0100 |
| commit | eab84e35b652f0d37b2e873d3b894dfe12e4a41b (patch) | |
| tree | 36950c39c431e3844f24753ec9aa902fee5b78ee | |
| parent | 0e71ddedb6098ffc0262fe8225c9b02f5433c9d0 (diff) | |
| download | xine-lib-eab84e35b652f0d37b2e873d3b894dfe12e4a41b.tar.gz xine-lib-eab84e35b652f0d37b2e873d3b894dfe12e4a41b.tar.bz2 | |
Avoid underflow in input size calculation for compressed atoms
if the atom size is shorter than the header size, do not try
to decompress anything, as this would lead to zlib reading
out of bound data.
| -rw-r--r-- | src/demuxers/demux_qt.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/demuxers/demux_qt.c b/src/demuxers/demux_qt.c index c569ef9a4..4ad71e958 100644 --- a/src/demuxers/demux_qt.c +++ b/src/demuxers/demux_qt.c @@ -2208,7 +2208,7 @@ static qt_error open_qt_file(qt_info *info, input_plugin_t *input, } /* check if moov is compressed */ - if (_X_BE_32(&moov_atom[12]) == CMOV_ATOM) { + if (_X_BE_32(&moov_atom[12]) == CMOV_ATOM && moov_atom_size >= 0x28) { info->compressed_header = 1; |