[MPlayer-cvslog] r37725 - trunk/libmpdemux/demux_mov.c

[reimar]

Author: reimar
Date: Sun Feb 14 14:52:15 2016
New Revision: 37725

Log:
demux_mov: improve loop limit check.

Abort if we would read out of range.

Modified:
   trunk/libmpdemux/demux_mov.c

Modified: trunk/libmpdemux/demux_mov.c
==============================================================================
--- trunk/libmpdemux/demux_mov.c	Sun Feb 14 14:34:37 2016	(r37724)
+++ trunk/libmpdemux/demux_mov.c	Sun Feb 14 14:52:15 2016	(r37725)
@@ -1216,7 +1216,7 @@ static int gen_sh_video(sh_video_t* sh,
 		  else
 		  {
 		    mp_msg(MSGT_DEMUX, MSGL_V, "Loading palette from file\n");
-		    for (i = start; i <= end; i++)
+		    for (i = start; i <= end && hdr_ptr < trak->stdata_len - 8; i++)
 		    {
 		      entry = AV_RB16(&trak->stdata[hdr_ptr]);
 		      hdr_ptr += 2;