[MPlayer-cvslog] CVS: main/libmpdemux demux_mov.c,1.124,1.125

[Reimar Döffinger CVS]

CVS change done by Reimar Döffinger CVS

Update of /cvsroot/mplayer/main/libmpdemux
In directory mail:/var2/tmp/cvs-serv21856

Modified Files:
	demux_mov.c 
Log Message:
Add missing range/length check for video trak desc (fixes bug #335).


Index: demux_mov.c
===================================================================
RCS file: /cvsroot/mplayer/main/libmpdemux/demux_mov.c,v
retrieving revision 1.124
retrieving revision 1.125
diff -u -r1.124 -r1.125
--- demux_mov.c	10 Jul 2005 08:57:31 -0000	1.124
+++ demux_mov.c	10 Jul 2005 09:05:14 -0000	1.125
@@ -801,9 +801,16 @@
 		int hdr_ptr = 76;  // the byte just after depth
 		unsigned char *palette_map;
 		sh_video_t* sh=new_sh_video(demuxer,priv->track_db);
-		int depth = trak->stdata[75]|(trak->stdata[74]<<8);
+		int depth;
 		sh->format=trak->fourcc;
 
+		if (trak->stdata_len < 78) {
+		  mp_msg(MSGT_DEMUXER, MSGL_WARN,
+		  "MOV: Invalid (%d bytes instead of >= 78) video trak desc\n",
+		  trak->stdata_len);
+		  break;
+		}
+		depth = trak->stdata[75] | (trak->stdata[74] << 8);
 //  stdata[]:
 //	8   short	version
 //	10  short	revision