From bf50607ab76157ba251a01f5baa5cf67b23b2ee9 Mon Sep 17 00:00:00 2001 From: Andreas Cadhalpun Date: Wed, 6 Jan 2016 20:59:58 +0100 Subject: asfdec: check for too small size in asf_read_unknown MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This fixes infinite loops due to seeking back. Signed-off-by: Alexandra Hájková Signed-off-by: Luca Barbato --- libavformat/asfdec.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'libavformat/asfdec.c') diff --git a/libavformat/asfdec.c b/libavformat/asfdec.c index aef61bbdd4..cbab9a2dd6 100644 --- a/libavformat/asfdec.c +++ b/libavformat/asfdec.c @@ -190,8 +190,13 @@ static int asf_read_unknown(AVFormatContext *s, const GUIDParseTable *g) if ((ret = detect_unknown_subobject(s, asf->unknown_offset, asf->unknown_size)) < 0) return ret; - } else + } else { + if (size < 24) { + av_log(s, AV_LOG_ERROR, "Too small size %"PRIu64" (< 24).\n", size); + return AVERROR_INVALIDDATA; + } avio_skip(pb, size - 24); + } return 0; } -- cgit v1.2.3