From 62b6498df2ef9f5fc65d581c8be48a6ff57de1e3 Mon Sep 17 00:00:00 2001
From: Baptiste Coudurier <baptiste.coudurier@gmail.com>
Date: Thu, 29 Mar 2007 10:37:07 +0000
Subject: break if atom size is more than size left in container atom, fix
 shooter.mov

Originally committed as revision 8544 to svn://svn.ffmpeg.org/ffmpeg/trunk
---
 libavformat/mov.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'libavformat/mov.c')

diff --git a/libavformat/mov.c b/libavformat/mov.c
index ce8afbca77..83dcdf0ec7 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -250,7 +250,7 @@ static int mov_read_default(MOVContext *c, ByteIOContext *pb, MOV_atom_t atom)
 
         a.size -= 8;
 
-        if(a.size < 0)
+        if(a.size < 0 || a.size > atom.size - total_size)
             break;
 
         if (c->parse_table[i].type == 0) { /* skip leaf atoms data */
-- 
cgit v1.2.3