qtdemux: sanity check number of segments in edit list

Fixes crash with fuzzed file.

https://bugzilla.gnome.org/show_bug.cgi?id=777940
This commit is contained in:
Tim-Philipp Müller 2017-01-30 20:20:08 +00:00
parent 7a6752a7e0
commit 19c9600ea6

View file

@ -8772,7 +8772,7 @@ qtdemux_parse_segments (GstQTDemux * qtdemux, QtDemuxStream * stream,
n_segments = QT_UINT32 (buffer + 12);
if (size < 16 + n_segments * entry_size) {
if (n_segments > 100000 || size < 16 + n_segments * entry_size) {
GST_WARNING_OBJECT (qtdemux, "Invalid edit list");
goto done;
}