From e4d1621c6e51c623061676439a55dfab89d330f6 Mon Sep 17 00:00:00 2001 From: Andreas Cadhalpun Date: Thu, 7 Jan 2016 10:22:00 +0100 Subject: asfdec: check avio_skip in asf_read_simple_index MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The loop can be very long, even though the file is very short. Signed-off-by: Andreas Cadhalpun Signed-off-by: Alexandra Hájková Signed-off-by: Luca Barbato --- libavformat/asfdec.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) (limited to 'libavformat/asfdec.c') diff --git a/libavformat/asfdec.c b/libavformat/asfdec.c index 460df2aeaf..aef61bbdd4 100644 --- a/libavformat/asfdec.c +++ b/libavformat/asfdec.c @@ -970,7 +970,7 @@ static int asf_read_simple_index(AVFormatContext *s, const GUIDParseTable *g) uint64_t interval; // index entry time interval in 100 ns units, usually it's 1s uint32_t pkt_num, nb_entries; int32_t prev_pkt_num = -1; - int i; + int i, ret; uint64_t size = avio_rl64(pb); // simple index objects should be ordered by stream number, this loop tries to find @@ -992,7 +992,11 @@ static int asf_read_simple_index(AVFormatContext *s, const GUIDParseTable *g) nb_entries = avio_rl32(pb); for (i = 0; i < nb_entries; i++) { pkt_num = avio_rl32(pb); - avio_skip(pb, 2); + ret = avio_skip(pb, 2); + if (ret < 0) { + av_log(s, AV_LOG_ERROR, "Skipping failed in asf_read_simple_index.\n"); + return ret; + } if (prev_pkt_num != pkt_num) { av_add_index_entry(st, asf->first_packet_offset + asf->packet_size * pkt_num, av_rescale(interval, i, 10000), -- cgit v1.2.3