From 0ad04bf6a29ee54374370d9fe1a6543439d6aa02 Mon Sep 17 00:00:00 2001 From: wm4 Date: Thu, 28 May 2015 14:30:14 +0200 Subject: dvdsubdec: reset buffer size on invalid over-large packets Otherwise it will never be reset, and remain "stuck" in this state forever. Can happen when seeking: the decoder will receive fragments from different file positions, which triggers the condition easily. Signed-off-by: Michael Niedermayer --- libavcodec/dvdsubdec.c | 1 + 1 file changed, 1 insertion(+) (limited to 'libavcodec/dvdsubdec.c') diff --git a/libavcodec/dvdsubdec.c b/libavcodec/dvdsubdec.c index 673fc6051e..a87a3bcdd4 100644 --- a/libavcodec/dvdsubdec.c +++ b/libavcodec/dvdsubdec.c @@ -519,6 +519,7 @@ static int append_to_cached_buf(AVCodecContext *avctx, if (ctx->buf_size >= sizeof(ctx->buf) - buf_size) { av_log(avctx, AV_LOG_WARNING, "Attempt to reconstruct " "too large SPU packets aborted.\n"); + ctx->buf_size = 0; return AVERROR_INVALIDDATA; } memcpy(ctx->buf + ctx->buf_size, buf, buf_size); -- cgit v1.2.3