diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-02-05 18:31:27 +0100 |
|---|---|---|
| committer | Carl Eugen Hoyos <cehoyos@ag.or.at> | 2013-02-06 00:10:05 +0100 |
| commit | 5a97a5291a83d2053aa2380e36bda1998b7e24eb (patch) | |
| tree | 11036363b5541b50b076d22c2d5bd80b9c2d5a7c | |
| parent | f6b50924a5fd4e83aff63f99107cb9475b68c972 (diff) | |
| download | ffmpeg-5a97a5291a83d2053aa2380e36bda1998b7e24eb.tar.gz | |
riff: fix infinite loop
Fixes Ticket2241
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a8343bfb6a3f00777943b94ff2969422f578f246)
| -rw-r--r-- | libavformat/riff.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/libavformat/riff.c b/libavformat/riff.c index 573e4179cd..c0b42c1f66 100644 --- a/libavformat/riff.c +++ b/libavformat/riff.c @@ -817,7 +817,13 @@ int ff_read_riff_info(AVFormatContext *s, int64_t size) chunk_code = avio_rl32(pb); chunk_size = avio_rl32(pb); - + if (url_feof(pb)) { + if (chunk_code || chunk_size) { + av_log(s, AV_LOG_WARNING, "INFO subchunk truncated\n"); + return AVERROR_INVALIDDATA; + } + break; + } if (chunk_size > end || end - chunk_size < cur || chunk_size == UINT_MAX) { avio_seek(pb, -9, SEEK_CUR); chunk_code = avio_rl32(pb); |