From 8ea04c66b8826737824a7bb9cd5979921f238acc Mon Sep 17 00:00:00 2001
From: Mark Nauwelaerts <mark.nauwelaerts@collabora.co.uk>
Date: Wed, 11 Aug 2010 11:17:18 +0200
Subject: [PATCH] qtdemux: prevent reading past avc1 atom when parsing

... when one of the subatoms has a large/invalid size.

Fixes #626609.
---
 gst/qtdemux/qtdemux.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/gst/qtdemux/qtdemux.c b/gst/qtdemux/qtdemux.c
index bfe68b0..ce1e5ab 100644
--- a/gst/qtdemux/qtdemux.c
+++ b/gst/qtdemux/qtdemux.c
@@ -5435,8 +5435,8 @@ qtdemux_parse_trak (GstQTDemux * qtdemux, GNode * trak)
                 break;
             }
 
-            len -= QT_UINT32 (avc_data);
-            avc_data += QT_UINT32 (avc_data);
+            len -= size + 8;
+            avc_data += size + 8;
           }
 
           break;
-- 
2.7.4