Commit 40662728 authored by Alexandra Hájková's avatar Alexandra Hájková Committed by Anton Khirnov

asfdec: do not read replicated data when their length is 0

Signed-off-by: 's avatarAnton Khirnov <anton@khirnov.net>
parent c9f8cfb6
...@@ -1123,6 +1123,7 @@ static int asf_read_multiple_payload(AVFormatContext *s, AVPacket *pkt, ...@@ -1123,6 +1123,7 @@ static int asf_read_multiple_payload(AVFormatContext *s, AVPacket *pkt,
if ((ret = asf_read_subpayload(s, pkt, 1)) < 0) if ((ret = asf_read_subpayload(s, pkt, 1)) < 0)
return ret; return ret;
} else { } else {
if (asf->rep_data_len) {
if (!asf_pkt->data_size) { if (!asf_pkt->data_size) {
asf_pkt->data_size = asf_pkt->size_left = avio_rl32(pb); // read media object size asf_pkt->data_size = asf_pkt->size_left = avio_rl32(pb); // read media object size
if (asf_pkt->data_size <= 0) if (asf_pkt->data_size <= 0)
...@@ -1132,8 +1133,9 @@ static int asf_read_multiple_payload(AVFormatContext *s, AVPacket *pkt, ...@@ -1132,8 +1133,9 @@ static int asf_read_multiple_payload(AVFormatContext *s, AVPacket *pkt,
} else } else
avio_skip(pb, 4); // reading of media object size is already done avio_skip(pb, 4); // reading of media object size is already done
asf_pkt->dts = avio_rl32(pb); // read presentation time asf_pkt->dts = avio_rl32(pb); // read presentation time
if ((asf->rep_data_len - 8) > 0) if (asf->rep_data_len && ((asf->rep_data_len - 8) > 0))
avio_skip(pb, asf->rep_data_len - 8); // skip replicated data avio_skip(pb, asf->rep_data_len - 8); // skip replicated data
}
pay_len = avio_rl16(pb); // payload length should be WORD pay_len = avio_rl16(pb); // payload length should be WORD
if (pay_len > asf->packet_size) { if (pay_len > asf->packet_size) {
av_log(s, AV_LOG_ERROR, av_log(s, AV_LOG_ERROR,
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment