From b79655d3c93ec2bd37d3dff40d909d6a65d41dbb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Thu, 1 Dec 2016 14:30:49 +0200
Subject: [PATCH] qtdemux: Ensure that size of the pasp atom is as much as we
 need

https://bugzilla.gnome.org/show_bug.cgi?id=775455
---
 gst/isomp4/qtdemux.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/gst/isomp4/qtdemux.c b/gst/isomp4/qtdemux.c
index 0f9f6f49ed..ce6ca2fe10 100644
--- a/gst/isomp4/qtdemux.c
+++ b/gst/isomp4/qtdemux.c
@@ -9762,9 +9762,15 @@ qtdemux_parse_trak (GstQTDemux * qtdemux, GNode * trak)
 
     if (pasp) {
       const guint8 *pasp_data = (const guint8 *) pasp->data;
+      gint len = QT_UINT32 (pasp_data);
 
-      stream->par_w = QT_UINT32 (pasp_data + 8);
-      stream->par_h = QT_UINT32 (pasp_data + 12);
+      if (len == 16) {
+        stream->par_w = QT_UINT32 (pasp_data + 8);
+        stream->par_h = QT_UINT32 (pasp_data + 12);
+      } else {
+        stream->par_w = 0;
+        stream->par_h = 0;
+      }
     } else {
       stream->par_w = 0;
       stream->par_h = 0;