diff options
| author | Darren Salt <linux@youmustbejoking.demon.co.uk> | 2009-04-01 02:49:51 +0100 |
|---|---|---|
| committer | Darren Salt <linux@youmustbejoking.demon.co.uk> | 2009-04-01 02:49:51 +0100 |
| commit | 1e81086a8196e09868e3726609b322f6acfabd04 (patch) | |
| tree | 1120702e3ee981c15d2c052ba0cc3260412053e0 /src | |
| parent | 7e63be8ffb88c1fe981c7cf39c535a5553e35b31 (diff) | |
| download | xine-lib-1e81086a8196e09868e3726609b322f6acfabd04.tar.gz xine-lib-1e81086a8196e09868e3726609b322f6acfabd04.tar.bz2 | |
Fix an integer overflow in the Quicktime demuxer.
--HG--
extra : transplant_source : %AE%D3%DCw%0F%073h%5D%C0%B5%A7%BA%2B%95%81%95bT%D6
Diffstat (limited to 'src')
| -rw-r--r-- | src/demuxers/demux_qt.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/src/demuxers/demux_qt.c b/src/demuxers/demux_qt.c index 4ad71e958..5aba5b479 100644 --- a/src/demuxers/demux_qt.c +++ b/src/demuxers/demux_qt.c @@ -1535,7 +1535,8 @@ static qt_error parse_trak_atom (qt_trak *trak, } else if (current_atom == STTS_ATOM) { /* there should only be one of these atoms */ - if (trak->time_to_sample_table) { + if (trak->time_to_sample_table + || current_atom_size < 12 || current_atom_size >= UINT_MAX) { last_error = QT_HEADER_TROUBLE; goto free_trak; } @@ -1545,6 +1546,11 @@ static qt_error parse_trak_atom (qt_trak *trak, debug_atom_load(" qt stts atom (time-to-sample atom): %d entries\n", trak->time_to_sample_count); + if (trak->time_to_sample_count > (current_atom_size - 12) / 8) { + last_error = QT_HEADER_TROUBLE; + goto free_trak; + } + trak->time_to_sample_table = (time_to_sample_table_t *)calloc( trak->time_to_sample_count+1, sizeof(time_to_sample_table_t)); if (!trak->time_to_sample_table) { |