diff options
| author | Edward Hervey <edward@centricular.com> | 2017-04-12 11:03:24 +0200 |
|---|---|---|
| committer | Edward Hervey <bilboed@bilboed.com> | 2017-04-12 11:03:24 +0200 |
| commit | 26f9869668ec5f18e011cd6f936b6f62778b051f (patch) | |
| tree | 5d09b68f7da7d37ddaaefbd4165a3f7d1c948e0e | |
| parent | 9ac3861a9bd91d534ba29933f05595e7416dfab7 (diff) | |
qtdemux: Add out-of-bound check
Make sure we don't read invalid memory
| -rw-r--r-- | gst/isomp4/qtdemux.c | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/gst/isomp4/qtdemux.c b/gst/isomp4/qtdemux.c index d7fdae822..64277f144 100644 --- a/gst/isomp4/qtdemux.c +++ b/gst/isomp4/qtdemux.c @@ -7964,8 +7964,16 @@ gst_qtdemux_stream_check_and_change_stsd_index (GstQTDemux * demux, GST_DEBUG_OBJECT (stream->pad, "Changing stsd index from '%u' to '%u'", stream->cur_stsd_entry_index, stream->stsd_sample_description_id); - stream->cur_stsd_entry_index = stream->stsd_sample_description_id; - stream->new_caps = TRUE; + if (G_UNLIKELY (stream->stsd_sample_description_id >= + stream->stsd_entries_length)) { + GST_ELEMENT_ERROR (demux, STREAM, DEMUX, + (_("This file is invalid and cannot be played.")), + ("New sample description id is out of bounds (%d >= %d)", + stream->stsd_sample_description_id, stream->stsd_entries_length)); + } else { + stream->cur_stsd_entry_index = stream->stsd_sample_description_id; + stream->new_caps = TRUE; + } } static gboolean |