From 0ea4742341726ebe42c301bc0d6426cfa01dd134 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 13 Dec 2012 15:07:20 +0100 Subject: [PATCH] qt-faststart: Check offset_count Fixes CID733836 Signed-off-by: Michael Niedermayer --- tools/qt-faststart.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/tools/qt-faststart.c b/tools/qt-faststart.c index ecf163a947..c9aa6e8287 100644 --- a/tools/qt-faststart.c +++ b/tools/qt-faststart.c @@ -235,6 +235,10 @@ int main(int argc, char *argv[]) goto error_out; } offset_count = BE_32(&moov_atom[i + 8]); + if (i + 12LL + offset_count * 4LL > moov_atom_size) { + printf(" bad atom size\n"); + goto error_out; + } for (j = 0; j < offset_count; j++) { current_offset = BE_32(&moov_atom[i + 12 + j * 4]); current_offset += moov_atom_size; @@ -252,6 +256,10 @@ int main(int argc, char *argv[]) goto error_out; } offset_count = BE_32(&moov_atom[i + 8]); + if (i + 12LL + offset_count * 8LL > moov_atom_size) { + printf(" bad atom size\n"); + goto error_out; + } for (j = 0; j < offset_count; j++) { current_offset = BE_64(&moov_atom[i + 12 + j * 8]); current_offset += moov_atom_size; -- 2.11.0