mxfdemux: Fix up another size check and prevent allocating too much memory

diff --git a/gst/mxf/mxfdemux.c b/gst/mxf/mxfdemux.c
index a38c332d9267211eaf6e2dc91dac4ad675c18008..525ff4337983c0a20a47adf7a23261fadaa1ff2a 100644 (file)
--- a/gst/mxf/mxfdemux.c
+++ b/gst/mxf/mxfdemux.c
@@ -1771,7 +1771,7 @@ gst_mxf_demux_handle_generic_container_essence_element (GstMXFDemux * demux,
 
       index->offset = demux->offset - demux->run_in;
       index->keyframe = keyframe;
-    } else {
+    } else if (etrack->position < G_MAXINT) {
       GstMXFDemuxIndex index;
 
       index.offset = demux->offset - demux->run_in;

diff --git a/gst/mxf/mxftypes.c b/gst/mxf/mxftypes.c
index 8355126a5c9dd80cc3c6cab76f27cc8252bd0568..ba7704b8c526560b8f3ed946398527f81fad9822 100644 (file)
--- a/gst/mxf/mxftypes.c
+++ b/gst/mxf/mxftypes.c
@@ -1224,7 +1224,8 @@ mxf_index_table_segment_parse (const MXFUL * ul,
         tag_data += 4;
         tag_size -= 4;
 
-        if (tag_size / 11 < len)
+        if (tag_size / (11 + 4 * segment->slice_count +
+                8 * segment->pos_table_count) < len)
           goto error;
 
         segment->index_entries = g_new0 (MXFIndexEntry, len);