[FFmpeg-cvslog] r25081 - trunk/libavformat/mov.c

[bcoudurier]

Author: bcoudurier
Date: Wed Sep  8 22:20:24 2010
New Revision: 25081

Log:
Check dref size based on a patch by google

Modified:
   trunk/libavformat/mov.c

Modified: trunk/libavformat/mov.c
==============================================================================
--- trunk/libavformat/mov.c	Wed Sep  8 22:18:14 2010	(r25080)
+++ trunk/libavformat/mov.c	Wed Sep  8 22:20:24 2010	(r25081)
@@ -345,6 +345,9 @@ static int mov_read_dref(MOVContext *c, 
         uint32_t size = get_be32(pb);
         int64_t next = url_ftell(pb) + size - 4;
 
+        if (size < 12)
+            return -1;
+
         dref->type = get_le32(pb);
         get_be32(pb); // version + flags
         dprintf(c->fc, "type %.4s size %d\n", (char*)&dref->type, size);