highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qt-faststart: Check offset_count

Browse Source 
Fixes CID733836
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer
2012-12-13 15:07:20 +01:00
parent eee8c94f50
commit 0ea4742341
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
tools/qt-faststart.c
View File

@ -235,6 +235,10 @@ int main(int argc, char *argv[])
goto error_out; goto error_out;
} }
offset_count = BE_32(&moov_atom[i + 8]); offset_count = BE_32(&moov_atom[i + 8]);
if (i + 12LL + offset_count * 4LL > moov_atom_size) {
printf(" bad atom size\n");
goto error_out;
}
for (j = 0; j < offset_count; j++) { for (j = 0; j < offset_count; j++) {
current_offset = BE_32(&moov_atom[i + 12 + j * 4]); current_offset = BE_32(&moov_atom[i + 12 + j * 4]);
current_offset += moov_atom_size; current_offset += moov_atom_size;
@ -252,6 +256,10 @@ int main(int argc, char *argv[])
goto error_out; goto error_out;
} }
offset_count = BE_32(&moov_atom[i + 8]); offset_count = BE_32(&moov_atom[i + 8]);
if (i + 12LL + offset_count * 8LL > moov_atom_size) {
printf(" bad atom size\n");
goto error_out;
}
for (j = 0; j < offset_count; j++) { for (j = 0; j < offset_count; j++) {
current_offset = BE_64(&moov_atom[i + 12 + j * 8]); current_offset = BE_64(&moov_atom[i + 12 + j * 8]);
current_offset += moov_atom_size; current_offset += moov_atom_size;