diff options
| author | Reimar Döffinger <Reimar.Doeffinger@gmx.de> | 2009-09-30 13:35:13 +0000 |
|---|---|---|
| committer | Reimar Döffinger <Reimar.Doeffinger@gmx.de> | 2009-09-30 13:35:13 +0000 |
| commit | 5dd76bd741022ee87c8a1945e4ef0d97467f70e3 (patch) | |
| tree | a44562ad6f479a2f630782efbdf490cc72fc9afe /libavformat/mpc8.c | |
| parent | 58f873dded3f43755fdd396145f246c91124f9eb (diff) | |
| download | ffmpeg-5dd76bd741022ee87c8a1945e4ef0d97467f70e3.tar.gz | |
Return an error when the parsed mpc chunk size is negative, otherwise we
might end up in an endless loop where the same chunk is parsed over and over.
Fixes a hang near the end for http://samples.mplayerhq.hu/A-codecs/musepack/sv8/sv8-tags.mpc
Originally committed as revision 20099 to svn://svn.ffmpeg.org/ffmpeg/trunk
Diffstat (limited to 'libavformat/mpc8.c')
| -rw-r--r-- | libavformat/mpc8.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavformat/mpc8.c b/libavformat/mpc8.c index 51817f1439..85cbb41f83 100644 --- a/libavformat/mpc8.c +++ b/libavformat/mpc8.c @@ -250,6 +250,8 @@ static int mpc8_read_packet(AVFormatContext *s, AVPacket *pkt) while(!url_feof(s->pb)){ pos = url_ftell(s->pb); mpc8_get_chunk_header(s->pb, &tag, &size); + if (size < 0) + return -1; if(tag == TAG_AUDIOPACKET){ if(av_get_packet(s->pb, pkt, size) < 0) return AVERROR(ENOMEM); |