diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2011-12-18 21:37:54 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-01-03 19:49:55 +0100 |
| commit | 9f1dde03d5a0d5b2dacbe279a2be37610883e6ad (patch) | |
| tree | ec03313ad727abbb415dc58f1704c3c31f9f94a8 | |
| parent | d0269db8e3369fddcfe5ce9daface2b95dde48da (diff) | |
| download | ffmpeg-9f1dde03d5a0d5b2dacbe279a2be37610883e6ad.tar.gz | |
mov: detect EOF in mov_read_dref()
This fixes a (near) infinite loop and Ticket783
Bug found by: cosminamironesei
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit af3f2a87da1d37e5f227c1c289f62e84422879c2)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavformat/mov.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavformat/mov.c b/libavformat/mov.c index 54fd3dfa22..97c16f6af8 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -431,6 +431,8 @@ static int mov_read_dref(MOVContext *c, AVIOContext *pb, MOVAtom atom) avio_skip(pb, 16); for (type = 0; type != -1 && avio_tell(pb) < next; ) { + if(url_feof(pb)) + return AVERROR(EOF); type = avio_rb16(pb); len = avio_rb16(pb); av_log(c->fc, AV_LOG_DEBUG, "type %d, len %d\n", type, len); |