MPlayer QuickTime STSD atom NULL Dereference DoS

[roeehay@…]

A specially crafted QuickTime file may cause MPlayer to NULL dereference.

faulty code:

libmpdemux/demux_mov.c:1758

trak->stdata_len = len - 8;
trak->stdata = malloc(trak->stdata_len);
stream_read(demuxer->stream, trak->stdata, trak->stdata_len);

The len DWORD is user controllable (STSD atom sample description size), this value is then passed to the malloc call. The value returned from the malloc call is used unsafely, becaus
malloc can return NULL on error conditions.

A malicious QuickTime file may cause the malloc operation to return NULL, by specifying a very large Sample Description Size.
Doing so will cause 'stream_read' (which later on calls memcpy) to NULL dereference, and crash mplayer.

[compn]

demux_mov is dead now, as -demuxer lavf is default for mov files, closing bug.