diff options
| author | Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> | 2015-05-23 23:32:12 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2015-08-20 14:29:12 +0200 |
| commit | cd83ff5d4c7036e1f95aecac502e9b7e66a77c81 (patch) | |
| tree | 1b90ea94422e686f0cfdb4e6358f1ad159227b96 | |
| parent | 22349b9f7d4ff813a08b50fa79113cf1e36f4936 (diff) | |
| download | ffmpeg-cd83ff5d4c7036e1f95aecac502e9b7e66a77c81.tar.gz | |
mov: abort on EOF in ff_mov_read_chan
Otherwise the loop can take a lot of time if num_descr is very large.
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit a5718863da99b54b6c853d45c84871c4a96a57c0)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavformat/mov_chan.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavformat/mov_chan.c b/libavformat/mov_chan.c index 3b91ed7054..b63310b270 100644 --- a/libavformat/mov_chan.c +++ b/libavformat/mov_chan.c @@ -566,6 +566,11 @@ int ff_mov_read_chan(AVFormatContext *s, AVIOContext *pb, AVStream *st, label_mask = 0; for (i = 0; i < num_descr; i++) { uint32_t label; + if (pb->eof_reached) { + av_log(s, AV_LOG_ERROR, + "reached EOF while reading channel layout\n"); + return AVERROR_INVALIDDATA; + } label = avio_rb32(pb); // mChannelLabel avio_rb32(pb); // mChannelFlags avio_rl32(pb); // mCoordinates[0] |