diff options
| author | Sebastian Dröge <sebastian@centricular.com> | 2016-11-25 16:46:45 +0200 |
|---|---|---|
| committer | Sebastian Dröge <sebastian@centricular.com> | 2016-11-25 16:46:45 +0200 |
| commit | d3b45a145f9b3a8eb9b75b24839f23fe916512d1 (patch) | |
| tree | 3bff9ebd67e750dbef07540f695254454a3856e7 /gst/mxf | |
| parent | 31a2f2d5a16d2bb321ed8fcad20fbaaa7b63ae20 (diff) | |
| download | gstreamer-plugins-bad-d3b45a145f9b3a8eb9b75b24839f23fe916512d1.tar.gz | |
mxfdemux: Fix up another size check and prevent allocating too much memory
Diffstat (limited to 'gst/mxf')
| -rw-r--r-- | gst/mxf/mxfdemux.c | 2 | ||||
| -rw-r--r-- | gst/mxf/mxftypes.c | 3 |
2 files changed, 3 insertions, 2 deletions
diff --git a/gst/mxf/mxfdemux.c b/gst/mxf/mxfdemux.c index a38c332d9..525ff4337 100644 --- a/gst/mxf/mxfdemux.c +++ b/gst/mxf/mxfdemux.c @@ -1771,7 +1771,7 @@ gst_mxf_demux_handle_generic_container_essence_element (GstMXFDemux * demux, index->offset = demux->offset - demux->run_in; index->keyframe = keyframe; - } else { + } else if (etrack->position < G_MAXINT) { GstMXFDemuxIndex index; index.offset = demux->offset - demux->run_in; diff --git a/gst/mxf/mxftypes.c b/gst/mxf/mxftypes.c index 8355126a5..ba7704b8c 100644 --- a/gst/mxf/mxftypes.c +++ b/gst/mxf/mxftypes.c @@ -1224,7 +1224,8 @@ mxf_index_table_segment_parse (const MXFUL * ul, tag_data += 4; tag_size -= 4; - if (tag_size / 11 < len) + if (tag_size / (11 + 4 * segment->slice_count + + 8 * segment->pos_table_count) < len) goto error; segment->index_entries = g_new0 (MXFIndexEntry, len); |