diff options
| author | Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> | 2016-01-06 13:54:59 +0100 |
|---|---|---|
| committer | Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> | 2016-01-27 23:45:44 +0100 |
| commit | e188c267c8719943aa7f6d5ada2bedb452830c1f (patch) | |
| tree | d8b6fc44117cc2187467611aa78ef0fa12b2a84b | |
| parent | 407ab167c07c9afb4aa3518f850241fad0ac0df9 (diff) | |
| download | ffmpeg-e188c267c8719943aa7f6d5ada2bedb452830c1f.tar.gz | |
asfdec_o: check avio_skip in asf_read_simple_index
The loop can be very long, even though the file is very short.
Reviewed-by: Alexandra Hájková <alexandra.khirnova@gmail.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 0002d845e873af4fd00f0519e0248b07d65bef5f)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
| -rw-r--r-- | libavformat/asfdec_o.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/libavformat/asfdec_o.c b/libavformat/asfdec_o.c index 2ccfe3a592..9ff0c4ef07 100644 --- a/libavformat/asfdec_o.c +++ b/libavformat/asfdec_o.c @@ -970,7 +970,7 @@ static int asf_read_simple_index(AVFormatContext *s, const GUIDParseTable *g) uint64_t interval; // index entry time interval in 100 ns units, usually it's 1s uint32_t pkt_num, nb_entries; int32_t prev_pkt_num = -1; - int i; + int i, ret; uint64_t size = avio_rl64(pb); // simple index objects should be ordered by stream number, this loop tries to find @@ -992,7 +992,11 @@ static int asf_read_simple_index(AVFormatContext *s, const GUIDParseTable *g) nb_entries = avio_rl32(pb); for (i = 0; i < nb_entries; i++) { pkt_num = avio_rl32(pb); - avio_skip(pb, 2); + ret = avio_skip(pb, 2); + if (ret < 0) { + av_log(s, AV_LOG_ERROR, "Skipping failed in asf_read_simple_index.\n"); + return ret; + } if (prev_pkt_num != pkt_num) { av_add_index_entry(st, asf->first_packet_offset + asf->packet_size * pkt_num, av_rescale(interval, i, 10000), |