summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorTim-Philipp Müller <tim.muller@collabora.co.uk>2009-08-20 16:47:25 +0100
committerTim-Philipp Müller <tim.muller@collabora.co.uk>2009-09-24 16:29:25 +0100
commitabaf91e428e597e0209fcbf156fd5fac8a16e658 (patch)
treec9589ef70b56168a8ccda150315ffaa901f7241f
parent25db7df49b624313ce97ebf1a255a80fac3f7c6b (diff)
qtdemux: error out correctly if we don't even have enough bytes for an atom header
-rw-r--r--gst/qtdemux/qtdemux.c18
1 files changed, 14 insertions, 4 deletions
diff --git a/gst/qtdemux/qtdemux.c b/gst/qtdemux/qtdemux.c
index 1dd054ad6..5193ca56b 100644
--- a/gst/qtdemux/qtdemux.c
+++ b/gst/qtdemux/qtdemux.c
@@ -3085,13 +3085,16 @@ static gboolean
qtdemux_parse_node (GstQTDemux * qtdemux, GNode * node, const guint8 * buffer,
guint length)
{
- guint32 fourcc;
- guint32 node_length;
+ guint32 fourcc = 0;
+ guint32 node_length = 0;
const QtNodeType *type;
const guint8 *end;
GST_LOG_OBJECT (qtdemux, "qtdemux_parse buffer %p length %u", buffer, length);
+ if (G_UNLIKELY (length < 8))
+ goto not_enough_data;
+
node_length = QT_UINT32 (buffer);
fourcc = QT_FOURCC (buffer + 4);
@@ -3108,7 +3111,7 @@ qtdemux_parse_node (GstQTDemux * qtdemux, GNode * node, const guint8 * buffer,
GST_FOURCC_ARGS (fourcc), node_length, type->name);
if (node_length > length)
- goto broken_file;
+ goto broken_atom_size;
if (type->flags & QT_FLAG_CONTAINER) {
qtdemux_parse_container (qtdemux, node, buffer + 8, end);
@@ -3238,7 +3241,14 @@ qtdemux_parse_node (GstQTDemux * qtdemux, GNode * node, const guint8 * buffer,
return TRUE;
/* ERRORS */
-broken_file:
+not_enough_data:
+ {
+ GST_ELEMENT_ERROR (qtdemux, STREAM, DEMUX,
+ (_("This file is corrupt and cannot be played.")),
+ ("Not enough data for an atom header, got only %u bytes", length));
+ return FALSE;
+ }
+broken_atom_size:
{
GST_ELEMENT_ERROR (qtdemux, STREAM, DEMUX,
(_("This file is corrupt and cannot be played.")),