| OLD | NEW |
| 1 diff -rpu -N orig/libavformat/mov.c ffmpeg-mt/libavformat/mov.c | 1 diff -rpu -N orig/libavformat/mov.c ffmpeg-mt/libavformat/mov.c |
| 2 --- orig/libavformat/mov.c» 2010-06-17 09:42:17.532286300 -0700 | 2 --- orig/libavformat/mov.c» 2010-06-24 19:19:08.059822000 -0700 |
| 3 +++ ffmpeg-mt/libavformat/mov.c»2010-06-17 09:42:18.696402700 -0700 | 3 +++ ffmpeg-mt/libavformat/mov.c»2010-06-24 19:19:09.853845000 -0700 |
| 4 @@ -342,6 +342,8 @@ static int mov_read_dref(MOVContext *c, | 4 @@ -342,6 +342,8 @@ static int mov_read_dref(MOVContext *c, |
| 5 MOVDref *dref = &sc->drefs[i]; | 5 MOVDref *dref = &sc->drefs[i]; |
| 6 uint32_t size = get_be32(pb); | 6 uint32_t size = get_be32(pb); |
| 7 int64_t next = url_ftell(pb) + size - 4; | 7 int64_t next = url_ftell(pb) + size - 4; |
| 8 + if (size < 8) | 8 + if (size < 8) |
| 9 + return -1; | 9 + return -1; |
| 10 | 10 |
| 11 dref->type = get_le32(pb); | 11 dref->type = get_le32(pb); |
| 12 get_be32(pb); // version + flags | 12 get_be32(pb); // version + flags |
| OLD | NEW |