qtdemux: sanity check number of segments in edit list

Fixes crash with fuzzed file.

https://bugzilla.gnome.org/show_bug.cgi?id=777940

diff --git a/gst/isomp4/qtdemux.c b/gst/isomp4/qtdemux.c
index 3e2ef06..2d9cc2a 100644 (file)
--- a/gst/isomp4/qtdemux.c
+++ b/gst/isomp4/qtdemux.c
@@ -8772,7 +8772,7 @@ qtdemux_parse_segments (GstQTDemux * qtdemux, QtDemuxStream * stream,
 
     n_segments = QT_UINT32 (buffer + 12);
 
-    if (size < 16 + n_segments * entry_size) {
+    if (n_segments > 100000 || size < 16 + n_segments * entry_size) {
       GST_WARNING_OBJECT (qtdemux, "Invalid edit list");
       goto done;
     }