Annotation of /trunk/mplayer/patches/mplayer-1.0_rc2-demux_mov_fix_20080129.patch
Parent Directory | Revision Log
Revision 462 -
(hide annotations)
(download)
Tue Feb 5 15:43:17 2008 UTC (16 years, 7 months ago) by niro
File size: 1051 byte(s)
Tue Feb 5 15:43:17 2008 UTC (16 years, 7 months ago) by niro
File size: 1051 byte(s)
-security fixes
1 | niro | 462 | --- trunk/libmpdemux/demux_mov.c 2008/01/29 22:13:20 25920 |
2 | +++ trunk/libmpdemux/demux_mov.c 2008/01/29 22:14:00 25922 | ||
3 | @@ -175,11 +175,12 @@ | ||
4 | i=trak->chunkmap_size; | ||
5 | while(i>0){ | ||
6 | --i; | ||
7 | - for(j=trak->chunkmap[i].first;j<last;j++){ | ||
8 | + j=FFMAX(trak->chunkmap[i].first, 0); | ||
9 | + for(;j<last;j++){ | ||
10 | trak->chunks[j].desc=trak->chunkmap[i].sdid; | ||
11 | trak->chunks[j].size=trak->chunkmap[i].spc; | ||
12 | } | ||
13 | - last=trak->chunkmap[i].first; | ||
14 | + last=FFMIN(trak->chunkmap[i].first, trak->chunks_size); | ||
15 | } | ||
16 | |||
17 | #if 0 | ||
18 | @@ -237,6 +238,8 @@ | ||
19 | s=0; | ||
20 | for(j=0;j<trak->durmap_size;j++){ | ||
21 | for(i=0;i<trak->durmap[j].num;i++){ | ||
22 | + if (s >= trak->samples_size) | ||
23 | + break; | ||
24 | trak->samples[s].pts=pts; | ||
25 | ++s; | ||
26 | pts+=trak->durmap[j].dur; | ||
27 | @@ -248,6 +251,8 @@ | ||
28 | for(j=0;j<trak->chunks_size;j++){ | ||
29 | off_t pos=trak->chunks[j].pos; | ||
30 | for(i=0;i<trak->chunks[j].size;i++){ | ||
31 | + if (s >= trak->samples_size) | ||
32 | + break; | ||
33 | trak->samples[s].pos=pos; | ||
34 | mp_msg(MSGT_DEMUX, MSGL_DBG3, "Sample %5d: pts=%8d off=0x%08X size=%d\n",s, | ||
35 | trak->samples[s].pts, |