From eab84e35b652f0d37b2e873d3b894dfe12e4a41b Mon Sep 17 00:00:00 2001 From: Matthias Hopf Date: Thu, 1 Jan 2009 01:58:17 +0100 Subject: Avoid underflow in input size calculation for compressed atoms if the atom size is shorter than the header size, do not try to decompress anything, as this would lead to zlib reading out of bound data. --- src/demuxers/demux_qt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/demuxers/demux_qt.c b/src/demuxers/demux_qt.c index c569ef9a4..4ad71e958 100644 --- a/src/demuxers/demux_qt.c +++ b/src/demuxers/demux_qt.c @@ -2208,7 +2208,7 @@ static qt_error open_qt_file(qt_info *info, input_plugin_t *input, } /* check if moov is compressed */ - if (_X_BE_32(&moov_atom[12]) == CMOV_ATOM) { + if (_X_BE_32(&moov_atom[12]) == CMOV_ATOM && moov_atom_size >= 0x28) { info->compressed_header = 1; -- cgit v1.2.3