[MPlayer-cvslog] CVS: main/libmpdemux demux_mov.c,1.130,1.131

[Reimar Döffinger CVS]

CVS change done by Reimar Döffinger CVS

Update of /cvsroot/mplayer/main/libmpdemux
In directory mail:/var2/tmp/cvs-serv18266

Modified Files:
	demux_mov.c 
Log Message:
Sanity-check codecdata_len, fixes crash in libfaad due to failed malloc for
http://images.apple.com/movies/us/hd_gallery/gl1800/480p/the_brothers_grimm_m480pa.mov


Index: demux_mov.c
===================================================================
RCS file: /cvsroot/mplayer/main/libmpdemux/demux_mov.c,v
retrieving revision 1.130
retrieving revision 1.131
diff -u -r1.130 -r1.131
--- demux_mov.c	16 Sep 2005 11:05:29 -0000	1.130
+++ demux_mov.c	27 Sep 2005 11:21:13 -0000	1.131
@@ -662,6 +662,7 @@
 //      32  char[4]	atom type (fourc charater code -> esds)		
 //      36  char[]  	atom data (len=size-8)
 
+// TODO: fix parsing for files using version 2.
 		trak->samplebytes=sh->samplesize=char2short(trak->stdata,18)/8;
 		trak->nchannels=sh->channels=char2short(trak->stdata,16);
 		/*printf("MOV: timescale: %d samplerate: %d durmap: %d (%d) -> %d (%d)\n",
@@ -711,8 +712,10 @@
 			    sh->codecdata = (unsigned char *)malloc(sh->codecdata_len);
 			    memcpy(sh->codecdata, &trak->stdata[52+char2int(trak->stdata,52)], sh->codecdata_len);
 		    } else {
+		      if (len > 8 && len + 44 < trak->stdata_len) {
 		    sh->codecdata_len = len-8;
 		    sh->codecdata = trak->stdata+44+8;
+		      }
 		    }
 		  }
 		}