[MPlayer-cvslog] r37651 - trunk/libmpdemux/demux_mov.c

[reimar]

Author: reimar
Date: Tue Feb  9 23:29:09 2016
New Revision: 37651

Log:
demux_mov: Limit codecdata_len to valid range.

Modified:
   trunk/libmpdemux/demux_mov.c

Modified: trunk/libmpdemux/demux_mov.c
==============================================================================
--- trunk/libmpdemux/demux_mov.c	Tue Feb  9 23:22:19 2016	(r37650)
+++ trunk/libmpdemux/demux_mov.c	Tue Feb  9 23:29:09 2016	(r37651)
@@ -748,8 +748,10 @@ static int gen_sh_audio(sh_audio_t* sh,
 			int frma_len = char2int(trak->stdata,52);
 			switch(char2int(trak->stdata,52+8)) {
 			 case MOV_FOURCC('a','l','a','c'):
-			  if (len >= 36 && frma_len <= len - 36) {
+			  if (len >= 36 && frma_len > 0 && frma_len <= len - 36) {
 			    sh->codecdata_len = char2int(trak->stdata,52+frma_len);
+			    if (sh->codecdata_len < 0 || sh->codecdata_len > len - 8 - frma_len)
+				sh->codecdata_len = len - 8 - frma_len;
 			    mp_msg(MSGT_DEMUX, MSGL_V, "MOV: Found alac atom (%d)!\n", sh->codecdata_len);
 			    sh->codecdata = malloc(sh->codecdata_len);
 			    memcpy(sh->codecdata, &trak->stdata[52+frma_len], sh->codecdata_len);