From: Matthew Waters <matthew@centricular.com>
Date: Thu, 25 Jun 2020 06:35:45 +0000 (+1000)
Subject: qtdemux: bail out when encountering an atom with a size of 0
X-Git-Tag: 1.19.3~509^2~407
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=37f0119f49904b186f1f237872535a7f30003eb5;p=platform%2Fupstream%2Fgstreamer.git

qtdemux: bail out when encountering an atom with a size of 0

A size 0 atom means the atom extends to the end of the file.  No further
valid atoms will ever follow.  Avoids a subsequent scan for an atom from
one byte earlier after encountering a size 0 atom.

Part-of: <https://gitlab.freedesktop.org/gstreamer/gst-plugins-good/-/merge_requests/643>
---

diff --git a/gst/isomp4/qtdemux.c b/gst/isomp4/qtdemux.c
index d4e127b..8fd74b8 100644
--- a/gst/isomp4/qtdemux.c
+++ b/gst/isomp4/qtdemux.c
@@ -8833,13 +8833,15 @@ qtdemux_find_atom (GstQTDemux * qtdemux, guint64 * offset,
     }
 
     if (lfourcc == fourcc) {
-      GST_DEBUG_OBJECT (qtdemux, "found fourcc at offset %" G_GUINT64_FORMAT,
-          *offset);
+      GST_DEBUG_OBJECT (qtdemux, "found '%" GST_FOURCC_FORMAT " at offset %"
+          G_GUINT64_FORMAT, GST_FOURCC_ARGS (fourcc), *offset);
       break;
     } else {
       GST_LOG_OBJECT (qtdemux,
           "skipping atom '%" GST_FOURCC_FORMAT "' at %" G_GUINT64_FORMAT,
-          GST_FOURCC_ARGS (fourcc), *offset);
+          GST_FOURCC_ARGS (lfourcc), *offset);
+      if (*offset == G_MAXUINT64)
+        goto locate_failed;
       *offset += *length;
     }
   }