Commit 53e099de authored by Baptiste Coudurier's avatar Baptiste Coudurier
Browse files

check atom size against edit_count to avoid very long loop

Originally committed as revision 19198 to svn://
parent 70606675
......@@ -1831,6 +1831,9 @@ static int mov_read_elst(MOVContext *c, ByteIOContext *pb, MOVAtom atom)
get_be24(pb); /* flags */
edit_count = get_be32(pb); /* entries */
if((uint64_t)edit_count*12+8 > atom.size)
return -1;
for(i=0; i<edit_count; i++){
int time;
int duration = get_be32(pb); /* Track duration */
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment