1 files changed, 36 insertions, 3 deletions

diff --git a/gst/isomp4/qtdemux.c b/gst/isomp4/qtdemux.c
index b4f6303c8..94e908701 100644
--- a/gst/isomp4/qtdemux.c
+++ b/gst/isomp4/qtdemux.c
@@ -5353,16 +5353,49 @@ gst_qtdemux_align_buffer (GstQTDemux * demux,
 }
 
 static guint8 *
-extract_cc_from_cdat (const guint8 * data, gsize size, gsize * cclen)
+extract_cc_from_data (QtDemuxStream * stream, const guint8 * data, gsize size,
+    gsize * cclen)
 {
   guint8 *res = NULL;
   guint32 atom_length, fourcc;
+  QtDemuxStreamStsdEntry *stsd_entry;
+
+  GST_MEMDUMP ("caption atom", data, size);
 
   *cclen = 0;
   if (size < 8)
     goto invalid_cdat;
   atom_length = QT_UINT32 (data);
   fourcc = QT_FOURCC (data + 4);
+  if (G_UNLIKELY (atom_length > size || atom_length == 8))
+    goto invalid_cdat;
+
+  /* Check if we have somethig compatible */
+  stsd_entry = CUR_STREAM (stream);
+  switch (stsd_entry->fourcc) {
+    case FOURCC_c608:
+      /* Should be cdat or cdt2 */
+      if (fourcc != FOURCC_cdat || fourcc != FOURCC_cdt2) {
+        GST_WARNING_OBJECT (stream->pad,
+            "Unknown data atom (%" GST_FOURCC_FORMAT ") for CEA608",
+            GST_FOURCC_ARGS (fourcc));
+        goto invalid_cdat;
+      }
+      break;
+    case FOURCC_c708:
+      if (fourcc != FOURCC_ccdp) {
+        GST_WARNING_OBJECT (stream->pad,
+            "Unknown data atom (%" GST_FOURCC_FORMAT ") for CEA708",
+            GST_FOURCC_ARGS (fourcc));
+        goto invalid_cdat;
+      }
+      break;
+    default:
+      /* Keep this here in case other closed caption formats are added */
+      g_assert_not_reached ();
+      break;
+  }
+
 
   if (G_UNLIKELY (atom_length > size || atom_length == 8
           || fourcc != FOURCC_cdat))
@@ -5421,8 +5454,8 @@ gst_qtdemux_process_buffer (GstQTDemux * qtdemux, QtDemuxStream * stream,
     guint8 *cc;
     gsize cclen = 0;
     /* For closed caption, we need to extract the information from the
-     * [cdat] atom */
-    cc = extract_cc_from_cdat (map.data, map.size, &cclen);
+     * [cdat],[cdt2] or [ccdp] atom */
+    cc = extract_cc_from_data (stream, map.data, map.size, &cclen);
     gst_buffer_unmap (buf, &map);
     gst_buffer_unref (buf);
     if (cc) {