diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2016-09-02 12:19:29 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2016-09-05 01:01:35 +0200 |
| commit | 1d90326f95a791db515f69a01a5f6ef867896d15 (patch) | |
| tree | 5bef19a3e0c6226cd9c40da367676d7d29b812e4 | |
| parent | 1b47c278a606f1bef198b6a7746edc70e0e7d84d (diff) | |
| download | ffmpeg-1d90326f95a791db515f69a01a5f6ef867896d15.tar.gz | |
avformat/avidec: Fix infinite loop in avi_read_nikon()
Fixes: 360/test.poc
Found-by: 连一汉 <lianyihan@360.cn>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e4e4a9cad7f21593d4bcb1f2404ea0d373c36c43)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/avidec.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavformat/avidec.c b/libavformat/avidec.c index a6459a0e05..72099806a6 100644 --- a/libavformat/avidec.c +++ b/libavformat/avidec.c @@ -344,14 +344,14 @@ static void avi_metadata_creation_time(AVDictionary **metadata, char *date) static void avi_read_nikon(AVFormatContext *s, uint64_t end) { - while (avio_tell(s->pb) < end) { + while (avio_tell(s->pb) < end && !avio_feof(s->pb)) { uint32_t tag = avio_rl32(s->pb); uint32_t size = avio_rl32(s->pb); switch (tag) { case MKTAG('n', 'c', 't', 'g'): /* Nikon Tags */ { uint64_t tag_end = avio_tell(s->pb) + size; - while (avio_tell(s->pb) < tag_end) { + while (avio_tell(s->pb) < tag_end && !avio_feof(s->pb)) { uint16_t tag = avio_rl16(s->pb); uint16_t size = avio_rl16(s->pb); const char *name = NULL; |