diff options
| author | Paul B Mahol <onemda@gmail.com> | 2017-11-12 20:26:42 +0100 |
|---|---|---|
| committer | Paul B Mahol <onemda@gmail.com> | 2017-11-12 20:29:26 +0100 |
| commit | 6665938ca8b7ad8b7ec77c23e611bb8224e88a90 (patch) | |
| tree | 53d8b0b0f62f7cf82dc4aa41541a601007207f2d /libavformat/ty.c | |
| parent | c31ce95f1c4c504ff9e3a90b1e4e37f695547c72 (diff) | |
avformat/ty: check if header is correctly parsed and is still present
Fixes #6829.
Signed-off-by: Paul B Mahol <onemda@gmail.com>
Diffstat (limited to 'libavformat/ty.c')
| -rw-r--r-- | libavformat/ty.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/libavformat/ty.c b/libavformat/ty.c index 02ab59aa2e..0f08e787f5 100644 --- a/libavformat/ty.c +++ b/libavformat/ty.c @@ -440,6 +440,8 @@ static int get_chunk(AVFormatContext *s) return AVERROR_INVALIDDATA; ty->rec_hdrs = parse_chunk_headers(ty->chunk + 4, num_recs); + if (!ty->rec_hdrs) + return AVERROR(ENOMEM); ty->cur_chunk_pos += 16 * num_recs; return 0; @@ -723,8 +725,8 @@ static int ty_read_packet(AVFormatContext *s, AVPacket *pkt) return AVERROR_EOF; while (ret <= 0) { - if (ty->first_chunk || ty->cur_rec >= ty->num_recs) { - if (get_chunk(s) < 0 || ty->num_recs == 0) + if (!ty->rec_hdrs || ty->first_chunk || ty->cur_rec >= ty->num_recs) { + if (get_chunk(s) < 0 || ty->num_recs <= 0) return AVERROR_EOF; } |