Blob Blame History Raw
From 6b8fdef590ee1a68fa62eb3cc201e61081800f9f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Hubert=20Figui=C3=A8re?= <hub@figuiere.net>
Date: Thu, 1 Feb 2018 21:02:45 -0500
Subject: [PATCH 4/5] Bug 102483 - Fix an infinite loop in QuickTime parser.

---
 source/XMPFiles/FormatSupport/QuickTime_Support.cpp | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/source/XMPFiles/FormatSupport/QuickTime_Support.cpp b/source/XMPFiles/FormatSupport/QuickTime_Support.cpp
index 31091ea..94ca145 100644
--- a/source/XMPFiles/FormatSupport/QuickTime_Support.cpp
+++ b/source/XMPFiles/FormatSupport/QuickTime_Support.cpp
@@ -737,7 +737,8 @@ bool TradQT_Manager::ParseCachedBoxes ( const MOOV_Manager & moovMgr )
 
 			miniLen = 4 + GetUns16BE ( boxPtr );	// ! Include header in local miniLen.
 			macLang  = GetUns16BE ( boxPtr+2);
-			if ( (miniLen <= 4) || (miniLen > (boxEnd - boxPtr)) ) continue;	// Ignore bad or empty values.
+			if ( (miniLen <= 4) || (miniLen > (boxEnd - boxPtr)) )
+				break;	// Ignore bad or empty values.
 			
 			XMP_StringPtr valuePtr = (char*)(boxPtr+4);
 			size_t valueLen = miniLen - 4;
-- 
2.17.2