From 8fa148d2f12383ae29a9e17e24d4feb7b7a0d071 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tim-Philipp=20M=C3=BCller?= <tim.muller@collabora.co.uk>
Date: Tue, 30 Jun 2009 13:12:09 +0100
Subject: [PATCH] qtdemux: more size checks, and use g_try_new0() instead of
 g_new0()

Whenever we alloc something based on a user-supplied size, we should
really use g_try_new(), otherwise we can easily be made to abort by
passing a ridiculously large number to us for allocing. Fixes
problems with some fuzzed files.
---
 gst/qtdemux/qtdemux.c | 24 +++++++++++++++++++++---
 1 file changed, 21 insertions(+), 3 deletions(-)

diff --git a/gst/qtdemux/qtdemux.c b/gst/qtdemux/qtdemux.c
index 6cf4a55f8c..4683cd0316 100644
--- a/gst/qtdemux/qtdemux.c
+++ b/gst/qtdemux/qtdemux.c
@@ -3481,11 +3481,17 @@ qtdemux_parse_samples (GstQTDemux * qtdemux, QtDemuxStream * stream,
 
     if (n_samples == 0)
       goto no_samples;
+    else if (n_samples < 0)
+      goto corrupt_file;
 
     GST_DEBUG_OBJECT (qtdemux, "stsz sample_size 0, allocating n_samples %d",
         n_samples);
+
+    samples = g_try_new0 (QtDemuxSample, n_samples);
+    if (samples == NULL)
+      goto out_of_memory;
+
     stream->n_samples = n_samples;
-    samples = g_new0 (QtDemuxSample, n_samples);
     stream->samples = samples;
 
     /* set the sample sizes */
@@ -3648,10 +3654,16 @@ qtdemux_parse_samples (GstQTDemux * qtdemux, QtDemuxStream * stream,
 
     if (n_samples == 0)
       goto no_samples;
+    else if (n_samples < 0)
+      goto corrupt_file;
+
+    GST_DEBUG_OBJECT (qtdemux, "allocating n_samples %d", n_samples);
+
+    samples = g_try_new0 (QtDemuxSample, n_samples);
+    if (samples == NULL)
+      goto out_of_memory;
 
     stream->n_samples = n_samples;
-    GST_DEBUG_OBJECT (qtdemux, "allocating n_samples %d", n_samples);
-    samples = g_new0 (QtDemuxSample, n_samples);
     stream->samples = samples;
 
     n_samples_per_chunk = QT_UINT32 (stsc_data + 12);
@@ -3729,6 +3741,7 @@ qtdemux_parse_samples (GstQTDemux * qtdemux, QtDemuxStream * stream,
     /* Fill in the pts_offsets */
     index = 0;
     ctts_p = ctts_data + 16;
+    /* FIXME: make sure we don't read beyond the atom size/boundary */
     for (i = 0; i < n_entries; i++) {
       count = QT_UINT32 (ctts_p);
       ctts_p += 4;
@@ -3758,6 +3771,11 @@ no_samples:
     GST_WARNING_OBJECT (qtdemux, "stream has no samples");
     return FALSE;
   }
+out_of_memory:
+  {
+    GST_WARNING_OBJECT (qtdemux, "failed to allocate %d samples", n_samples);
+    return FALSE;
+  }
 }
 
 /* collect all segment info for @stream.