diff options
| author | Andreas Cadhalpun <andreas.cadhalpun@googlemail.com> | 2016-01-07 10:02:53 +0100 |
|---|---|---|
| committer | Luca Barbato <lu_zero@gentoo.org> | 2016-02-07 03:12:33 +0100 |
| commit | 2e6ba1993ef41af4a224e854077e4ba4d30f246b (patch) | |
| tree | d926e23c7b1fd9f6719fd480eff450b931998b25 /libavformat/asfdec.c | |
| parent | bf50607ab76157ba251a01f5baa5cf67b23b2ee9 (diff) | |
asfdec: make sure packet_size is non-zero before seeking
This fixes infinite loops due to seeking back.
Signed-off-by: Alexandra Hájková <alexandra@khirnov.net>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Diffstat (limited to 'libavformat/asfdec.c')
| -rw-r--r-- | libavformat/asfdec.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavformat/asfdec.c b/libavformat/asfdec.c index cbab9a2dd6..85d32668f8 100644 --- a/libavformat/asfdec.c +++ b/libavformat/asfdec.c @@ -1291,6 +1291,10 @@ static int asf_read_payload(AVFormatContext *s, AVPacket *pkt) } if (!asf_pkt) { if (asf->packet_offset + asf->packet_size <= asf->data_offset + asf->data_size) { + if (!asf->packet_size) { + av_log(s, AV_LOG_ERROR, "Invalid packet size 0.\n"); + return AVERROR_INVALIDDATA; + } avio_seek(pb, asf->packet_offset + asf->packet_size, SEEK_SET); av_log(s, AV_LOG_WARNING, "Skipping the stream with the invalid stream index %d.\n", asf->stream_index); |