demux_qt.c in xine-lib 1.1.12 and other 1.1.15 and earlier versions does not validate the count field before calling calloc for STSD_ATOM atom allocation which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted media file.