Fixes (the second part of) #49.
Unified · Split
| @@ -343,10 +343,13 @@ static int stszin(int size) · 342 unmodified lines | |||
| 343 | u32in(); | 343 | u32in(); |
| 344 | // Number of entries | 344 | // Number of entries |
| 345 | mp4config.frame.ents = u32in(); | 345 | mp4config.frame.ents = u32in(); |
| 346 | // fixme error checking | ||
| 347 | // fixme: check atom size | 346 | // fixme: check atom size |
| 348 | mp4config.frame.data = malloc(sizeof(*mp4config.frame.data) | 347 | mp4config.frame.data = malloc(sizeof(*mp4config.frame.data) |
| 349 | * (mp4config.frame.ents + 1)); | 348 | * (mp4config.frame.ents + 1)); |
| 349 | |||
| 350 | if (!mp4config.frame.data) | ||
| 351 | return ERR_FAIL; | ||
| 352 | |||
| 350 | ofs = 0; | 353 | ofs = 0; |
| 351 | mp4config.frame.data[0] = ofs; | 354 | mp4config.frame.data[0] = ofs; |
| 352 | for (cnt = 0; cnt < mp4config.frame.ents; cnt++) | 355 | for (cnt = 0; cnt < mp4config.frame.ents; cnt++) |
| @@ -358,6 +361,9 @@ static int stszin(int size) · 5 unmodified lines | |||
| 358 | mp4config.frame.maxsize = fsize; | 361 | mp4config.frame.maxsize = fsize; |
| 359 | 362 | ||
| 360 | mp4config.frame.data[cnt + 1] = ofs; | 363 | mp4config.frame.data[cnt + 1] = ofs; |
| 364 | |||
| 365 | if (ofs < mp4config.frame.data[cnt]) | ||
| 366 | return ERR_FAIL; | ||
| 361 | } | 367 | } |
| 362 | 368 | ||
| 363 | return size; | 369 | return size; |