aboutsummaryrefslogtreecommitdiffstats
path: root/libavformat/asfdec_o.c
diff options
context:
space:
mode:
authorAndreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>2016-01-06 19:03:17 +0100
committerAndreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>2016-01-15 00:39:30 +0100
commit3776a72962b0622af17c4aef89a831da2cbaceca (patch)
tree6af571b1254d62268f4c81ec744e887859f4a3fd /libavformat/asfdec_o.c
parent74474750f1ac522730dae271a5ea5003caa8b73c (diff)
downloadffmpeg-3776a72962b0622af17c4aef89a831da2cbaceca.tar.gz
asfdec_o: make sure packet_size is non-zero before seeking
This fixes infinite loops due to seeking back. Reviewed-by: Alexandra Hájková <alexandra.khirnova@gmail.com> Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Diffstat (limited to 'libavformat/asfdec_o.c')
-rw-r--r--libavformat/asfdec_o.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/libavformat/asfdec_o.c b/libavformat/asfdec_o.c
index b81519fb18..4a3c81501e 100644
--- a/libavformat/asfdec_o.c
+++ b/libavformat/asfdec_o.c
@@ -1287,6 +1287,10 @@ static int asf_read_payload(AVFormatContext *s, AVPacket *pkt)
}
if (!asf_pkt) {
if (asf->packet_offset + asf->packet_size <= asf->data_offset + asf->data_size) {
+ if (!asf->packet_size) {
+ av_log(s, AV_LOG_ERROR, "Invalid packet size 0.\n");
+ return AVERROR_INVALIDDATA;
+ }
avio_seek(pb, asf->packet_offset + asf->packet_size, SEEK_SET);
av_log(s, AV_LOG_WARNING, "Skipping the stream with the invalid stream index %d.\n",
asf->stream_index);