[FFmpeg-cvslog] r10481 - trunk/libavformat/mov.c

[bcoudurier]

Author: bcoudurier
Date: Wed Sep 12 12:18:01 2007
New Revision: 10481

Log:
stop parsing udta if size is wrong/garbage, fix issue 154, fix RQ004F14.MOV

Modified:
   trunk/libavformat/mov.c

Modified: trunk/libavformat/mov.c
==============================================================================
--- trunk/libavformat/mov.c	(original)
+++ trunk/libavformat/mov.c	Wed Sep 12 12:18:01 2007
@@ -1060,6 +1060,9 @@ static int mov_read_udta(MOVContext *c, 
         uint32_t tag      = get_le32(pb);
         uint64_t next     = url_ftell(pb) + tag_size - 8;
 
+        if (next > end) // stop if tag_size is wrong
+            break;
+
         switch (tag) {
         case MKTAG(0xa9,'n','a','m'):
             mov_parse_udta_string(pb, c->fc->title,     sizeof(c->fc->title));