stop parsing if tag size is wrongly < 8 to avoid infinite loop

Originally committed as revision 15401 to svn://svn.ffmpeg.org/ffmpeg/trunk
17 years ago · 4e240985d8
parent f2d65a6c8a
commit 4e240985d8
1 changed files with 1 additions and 1 deletions
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@ -1379,7 +1379,7 @@ static int mov_read_udta(MOVContext *c, ByteIOContext *pb, MOV_atom_t atom)
        uint32_t tag      = get_le32(pb);
        uint64_t next     = url_ftell(pb) + tag_size - 8;

-        if (next > end) // stop if tag_size is wrong
+        if (tag_size < 8 || next > end) // stop if tag_size is wrong
            break;

        switch (tag) {