[FFmpeg-cvslog] r19198 - trunk/libavformat/mov.c

[bcoudurier]

Author: bcoudurier
Date: Mon Jun 15 04:07:41 2009
New Revision: 19198

Log:
check atom size against edit_count to avoid very long loop

Modified:
   trunk/libavformat/mov.c

Modified: trunk/libavformat/mov.c
==============================================================================
--- trunk/libavformat/mov.c	Mon Jun 15 03:41:59 2009	(r19197)
+++ trunk/libavformat/mov.c	Mon Jun 15 04:07:41 2009	(r19198)
@@ -1831,6 +1831,9 @@ static int mov_read_elst(MOVContext *c, 
     get_be24(pb); /* flags */
     edit_count = get_be32(pb); /* entries */
 
+    if((uint64_t)edit_count*12+8 > atom.size)
+        return -1;
+
     for(i=0; i<edit_count; i++){
         int time;
         int duration = get_be32(pb); /* Track duration */