[MPlayer-cvslog] CVS: main/libmpdemux demux_mov.c,1.126,1.127

[Reimar Döffinger CVS]

CVS change done by Reimar Döffinger CVS

Update of /cvsroot/mplayer/main/libmpdemux
In directory mail:/var2/tmp/cvs-serv29379/libmpdemux

Modified Files:
	demux_mov.c 
Log Message:
extra size checks for samples array to avoid crashes in some rare cases.


Index: demux_mov.c
===================================================================
RCS file: /cvsroot/mplayer/main/libmpdemux/demux_mov.c,v
retrieving revision 1.126
retrieving revision 1.127
diff -u -r1.126 -r1.127
--- demux_mov.c	5 Aug 2005 19:57:46 -0000	1.126
+++ demux_mov.c	30 Aug 2005 23:24:47 -0000	1.127
@@ -194,6 +194,14 @@
         trak->chunks[j].sample=s;
         s+=trak->chunks[j].size;
     }
+    i = 0;
+    for (j = 0; j < trak->durmap_size; j++)
+      i += trak->durmap[j].num;
+    if (i != s) {
+      mp_msg(MSGT_DEMUX, MSGL_WARN,
+             "MOV: durmap and chunkmap sample count differ (%i vs %i)\n", i, s);
+      if (i > s) s = i;
+    }
 
     // workaround for fixed-size video frames (dv and uncompressed)
     if(!trak->samples_size && trak->type!=MOV_TRAK_AUDIO){
@@ -212,6 +220,14 @@
 	return;
     }
     
+    if (trak->samples_size < s) {
+      mp_msg(MSGT_DEMUX, MSGL_WARN,
+             "MOV: durmap or chunkmap bigger than sample count (%i vs %i)\n",
+             s, trak->samples_size);
+      trak->samples_size = s;
+      trak->samples = realloc(trak->samples, sizeof(mov_sample_t) * s);
+    }
+
     // calc pts:
     s=0;
     for(j=0;j<trak->durmap_size;j++){