diff options
Diffstat (limited to 'src/demuxers/demux_qt.c')
| -rw-r--r-- | src/demuxers/demux_qt.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/src/demuxers/demux_qt.c b/src/demuxers/demux_qt.c index 972395533..0f3c42276 100644 --- a/src/demuxers/demux_qt.c +++ b/src/demuxers/demux_qt.c @@ -1581,7 +1581,8 @@ static qt_error parse_trak_atom (qt_trak *trak, case STTS_ATOM: /* there should only be one of these atoms */ - if (trak->time_to_sample_table) { + if (trak->time_to_sample_table + || current_atom_size < 12 || current_atom_size >= UINT_MAX) { last_error = QT_HEADER_TROUBLE; goto free_trak; } @@ -1591,6 +1592,11 @@ static qt_error parse_trak_atom (qt_trak *trak, debug_atom_load(" qt stts atom (time-to-sample atom): %d entries\n", trak->time_to_sample_count); + if (trak->time_to_sample_count > (current_atom_size - 12) / 8) { + last_error = QT_HEADER_TROUBLE; + goto free_trak; + } + trak->time_to_sample_table = calloc(trak->time_to_sample_count+1, sizeof(time_to_sample_table_t)); if (!trak->time_to_sample_table) { last_error = QT_NO_MEMORY; |