From 32eae2b166064f134ef0ac6bcda65e5cd41b4efb Mon Sep 17 00:00:00 2001
From: Edward Hervey <edward@centricular.com>
Date: Thu, 7 Dec 2017 16:09:55 +0100
Subject: [PATCH] typefind: Fix previous commit

We need to make sure we have *enough* data to read (including the
next 4 bytes)
---
 gst/typefind/gsttypefindfunctions.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gst/typefind/gsttypefindfunctions.c b/gst/typefind/gsttypefindfunctions.c
index cffd8f7cc6..0cb7c0dfa0 100644
--- a/gst/typefind/gsttypefindfunctions.c
+++ b/gst/typefind/gsttypefindfunctions.c
@@ -3146,7 +3146,7 @@ q3gp_type_find (GstTypeFind * tf, gpointer unused)
     ftyp_size = GST_READ_UINT32_BE (data);
   }
   if ((data = gst_type_find_peek (tf, 0, ftyp_size)) != NULL) {
-    for (offset = 16; offset < ftyp_size; offset += 4) {
+    for (offset = 16; offset + 4 < ftyp_size; offset += 4) {
       if ((profile = q3gp_type_find_get_profile (data + offset))) {
         gst_type_find_suggest_simple (tf, GST_TYPE_FIND_MAXIMUM,
             "application/x-3gp", "profile", G_TYPE_STRING, profile, NULL);