Commit 2f215bf9 authored by Ronald S. Bultje's avatar Ronald S. Bultje

gst/qtdemux/qtdemux.c: Fix crash (j might be greater than n_samples, in which...

gst/qtdemux/qtdemux.c: Fix crash (j might be greater than n_samples, in which case we're writing outside the allocate...

Original commit message from CVS:
* gst/qtdemux/qtdemux.c: (gst_qtdemux_add_stream),
(qtdemux_parse_trak):
Fix crash (j might be greater than n_samples, in which case we're
writing outside the allocated space for the array) and memleak.
parent 63f2860f
2004-03-06 Ronald Bultje <rbultje@ronald.bitfreak.net>
* gst/qtdemux/qtdemux.c: (gst_qtdemux_add_stream),
(qtdemux_parse_trak):
Fix crash (j might be greater than n_samples, in which case we're
writing outside the allocated space for the array) and memleak.
2004-03-06 Ronald Bultje <rbultje@ronald.bitfreak.net> 2004-03-06 Ronald Bultje <rbultje@ronald.bitfreak.net>
* sys/oss/gstosssink.c: (gst_osssink_chain): * sys/oss/gstosssink.c: (gst_osssink_chain):
......
...@@ -687,9 +687,10 @@ static void gst_qtdemux_loop_header (GstElement *element) ...@@ -687,9 +687,10 @@ static void gst_qtdemux_loop_header (GstElement *element)
void gst_qtdemux_add_stream(GstQTDemux *qtdemux, QtDemuxStream *stream) void gst_qtdemux_add_stream(GstQTDemux *qtdemux, QtDemuxStream *stream)
{ {
if(stream->subtype == GST_MAKE_FOURCC('v','i','d','e')){ if(stream->subtype == GST_MAKE_FOURCC('v','i','d','e')){
gchar *name = g_strdup_printf ("video_%02d", qtdemux->n_video_streams);
stream->pad = gst_pad_new_from_template ( stream->pad = gst_pad_new_from_template (
gst_static_pad_template_get(&gst_qtdemux_videosrc_template), gst_static_pad_template_get(&gst_qtdemux_videosrc_template), name);
g_strdup_printf ("video_%02d", qtdemux->n_video_streams)); g_free (name);
stream->fps = 1. * GST_SECOND / stream->samples[0].duration; stream->fps = 1. * GST_SECOND / stream->samples[0].duration;
if(stream->caps){ if(stream->caps){
gst_caps_set_simple(stream->caps, gst_caps_set_simple(stream->caps,
...@@ -699,9 +700,10 @@ void gst_qtdemux_add_stream(GstQTDemux *qtdemux, QtDemuxStream *stream) ...@@ -699,9 +700,10 @@ void gst_qtdemux_add_stream(GstQTDemux *qtdemux, QtDemuxStream *stream)
} }
qtdemux->n_video_streams++; qtdemux->n_video_streams++;
}else{ }else{
gchar *name = g_strdup_printf ("audio_%02d", qtdemux->n_audio_streams);
stream->pad = gst_pad_new_from_template ( stream->pad = gst_pad_new_from_template (
gst_static_pad_template_get(&gst_qtdemux_audiosrc_template), gst_static_pad_template_get(&gst_qtdemux_audiosrc_template), name);
g_strdup_printf ("audio_%02d", qtdemux->n_audio_streams)); g_free (name);
if(stream->caps){ if(stream->caps){
gst_caps_set_simple(stream->caps, gst_caps_set_simple(stream->caps,
"rate", G_TYPE_INT, (int)stream->rate, "rate", G_TYPE_INT, (int)stream->rate,
...@@ -1600,6 +1602,7 @@ done: ...@@ -1600,6 +1602,7 @@ done:
for(j=first_chunk;j<last_chunk;j++){ for(j=first_chunk;j<last_chunk;j++){
int chunk_offset; int chunk_offset;
if(j>=n_samples)goto done2;
if(stco){ if(stco){
chunk_offset = QTDEMUX_GUINT32_GET(stco->data + 16 + j*4); chunk_offset = QTDEMUX_GUINT32_GET(stco->data + 16 + j*4);
}else{ }else{
...@@ -1620,7 +1623,6 @@ done: ...@@ -1620,7 +1623,6 @@ done:
#endif #endif
samples[j].sample_index = sample_index; samples[j].sample_index = sample_index;
sample_index += samples_per_chunk; sample_index += samples_per_chunk;
if(j>=n_samples)goto done2;
} }
} }
/* /*
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment