From 57ab08fd4736de3a6fb143d054091cb5f1f225f0 Mon Sep 17 00:00:00 2001
From: Maxim Dounin <mdounin@mdounin.ru>
Date: Fri, 29 Mar 2013 17:20:59 +0000
Subject: [PATCH] Merge of r5098: mp4: fixed handling of too small mdat atoms.

Mp4: fixed handling of too small mdat atoms (ticket #266).

Patch by Gernot Vormayr (with minor changes).
---
 src/http/modules/ngx_http_mp4_module.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/http/modules/ngx_http_mp4_module.c b/src/http/modules/ngx_http_mp4_module.c
index d3be23420..e793f77b7 100644
--- a/src/http/modules/ngx_http_mp4_module.c
+++ b/src/http/modules/ngx_http_mp4_module.c
@@ -750,6 +750,13 @@ ngx_http_mp4_process(ngx_http_mp4_file_t *mp4)
 
     *prev = &mp4->mdat_atom;
 
+    if (start_offset > mp4->mdat_data.buf->file_last) {
+        ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
+                      "start time is out mp4 mdat atom in \"%s\"",
+                      mp4->file.name.data);
+        return NGX_ERROR;
+    }
+
     adjustment = mp4->ftyp_size + mp4->moov_size
                  + ngx_http_mp4_update_mdat_atom(mp4, start_offset)
                  - start_offset;