On Mon, Sep 7, 2015 at 12:08 PM, Alexandra Hájková
<alexandra.khirn...@gmail.com> wrote:
> ---
> libavformat/asfdec.c | 8 +++++---
> 1 file changed, 5 insertions(+), 3 deletions(-)
>
> diff --git a/libavformat/asfdec.c b/libavformat/asfdec.c
> index b7b8d6c..f7d8859 100644
> --- a/libavformat/asfdec.c
> +++ b/libavformat/asfdec.c
> @@ -1141,7 +1141,7 @@ static int asf_read_replicated_data(AVFormatContext *s,
> ASFPacket *asf_pkt)
> if (!asf_pkt->data_size) {
> asf_pkt->data_size = asf_pkt->size_left = avio_rl32(pb); // read
> media object size
> if (asf_pkt->data_size <= 0)
> - return AVERROR_EOF;
> + return AVERROR_INVALIDDATA;
> if ((ret = av_new_packet(&asf_pkt->avpkt, asf_pkt->data_size)) < 0)
> return ret;
> } else
> @@ -1190,6 +1190,8 @@ static int asf_read_multiple_payload(AVFormatContext
> *s, AVPacket *pkt,
> skip = pay_len - asf_pkt->size_left;
> pay_len = asf_pkt->size_left;
> }
> + if (asf_pkt->size_left <= 0)
> + return AVERROR_INVALIDDATA;
> if ((ret = avio_read(pb, p, pay_len)) < 0)
> return ret;
> if (s->key && s->keylen == 20)
> @@ -1237,13 +1239,13 @@ static int asf_read_single_payload(AVFormatContext
> *s, AVPacket *pkt,
> return AVERROR_INVALIDDATA;
> }
> p = asf_pkt->avpkt.data + asf_pkt->data_size - asf_pkt->size_left;
> - if (size > asf_pkt->size_left)
> + if (size > asf_pkt->size_left || asf_pkt->size_left <= 0)
> return AVERROR_INVALIDDATA;
> if (asf_pkt->size_left > size)
> asf_pkt->size_left -= size;
> else
> asf_pkt->size_left = 0;
> - if ((ret = avio_read(pb, p, size)) < 0)
> + if ((ret = avio_read(pb, p, size)) < 0)
Unrelated/wrong re-indent?
> return ret;
> if (s->key && s->keylen == 20)
> ff_asfcrypt_dec(s->key, p, ret);
> --
> 2.0.1
>
> _______________________________________________
> libav-devel mailing list
> libav-devel@libav.org
> https://lists.libav.org/mailman/listinfo/libav-devel
_______________________________________________
libav-devel mailing list
libav-devel@libav.org
https://lists.libav.org/mailman/listinfo/libav-devel
