diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2011-12-18 21:37:54 +0100 |
|---|---|---|
| committer | Luca Barbato <lu_zero@gentoo.org> | 2012-09-16 16:31:03 +0200 |
| commit | 9db67bedf0e517c19dad02db1752a5dfb52eaa69 (patch) | |
| tree | b1cf8ed970f786623068dbb0a71da0264b1deeeb | |
| parent | 4ed5ac50d3e4f921003ecf60985f78337400f354 (diff) | |
mov: detect EOF in mov_read_dref()
Avoid a near infinite loop.
Issue discovered by cosminamironesei.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
| -rw-r--r-- | libavformat/mov.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavformat/mov.c b/libavformat/mov.c index 640377a134..09228cb011 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -416,6 +416,8 @@ static int mov_read_dref(MOVContext *c, AVIOContext *pb, MOVAtom atom) avio_skip(pb, 16); for (type = 0; type != -1 && avio_tell(pb) < next; ) { + if (pb->eof_reached) + return AVERROR_EOF; type = avio_rb16(pb); len = avio_rb16(pb); av_log(c->fc, AV_LOG_DEBUG, "type %d, len %d\n", type, len); |