diff options
| author | Sebastian Dröge <sebastian@centricular.com> | 2016-12-01 14:29:21 +0200 |
|---|---|---|
| committer | Sebastian Dröge <sebastian@centricular.com> | 2016-12-01 14:29:21 +0200 |
| commit | b4d6b2af8efcc6f2c008542041a9abcdc57e899e (patch) | |
| tree | b09587e08b9099721407bb736874b66df695cacb | |
| parent | 5e4883094b45204d79ea611ef5a38c60f9e9604f (diff) | |
qtdemux: Check size of compressed MOOV header against available data
And actually read the size of the cmvd atom from the right position.
https://bugzilla.gnome.org/show_bug.cgi?id=775455
| -rw-r--r-- | gst/isomp4/qtdemux.c | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/gst/isomp4/qtdemux.c b/gst/isomp4/qtdemux.c index 1defb1e84..207993704 100644 --- a/gst/isomp4/qtdemux.c +++ b/gst/isomp4/qtdemux.c @@ -6936,12 +6936,17 @@ qtdemux_parse_moov (GstQTDemux * qtdemux, const guint8 * buffer, guint length) guint32 method; GNode *dcom; GNode *cmvd; + guint32 dcom_len; dcom = qtdemux_tree_get_child_by_type (cmov, FOURCC_dcom); cmvd = qtdemux_tree_get_child_by_type (cmov, FOURCC_cmvd); if (dcom == NULL || cmvd == NULL) goto invalid_compression; + dcom_len = QT_UINT32 (dcom->data); + if (dcom_len < 12) + goto invalid_compression; + method = QT_FOURCC ((guint8 *) dcom->data + 8); switch (method) { #ifdef HAVE_ZLIB @@ -6949,9 +6954,14 @@ qtdemux_parse_moov (GstQTDemux * qtdemux, const guint8 * buffer, guint length) guint uncompressed_length; guint compressed_length; guint8 *buf; + guint32 cmvd_len; + + cmvd_len = QT_UINT32 ((guint8 *) cmvd->data); + if (cmvd_len < 12) + goto invalid_compression; uncompressed_length = QT_UINT32 ((guint8 *) cmvd->data + 8); - compressed_length = QT_UINT32 ((guint8 *) cmvd->data + 4) - 12; + compressed_length = cmvd_len - 12; GST_LOG ("length = %u", uncompressed_length); buf = |