Commit 44ed34b7 authored by Reimar Döffinger's avatar Reimar Döffinger

Check for seek failures in avi_load_index, otherwise if the index offset

is invalid (e.g. truncated file) we might end up reading the whole file
since trying to seek beyond the end of file does not set EOF.

Originally committed as revision 19709 to svn://svn.ffmpeg.org/ffmpeg/trunk
parent d5a30f86
...@@ -1001,8 +1001,10 @@ static int avi_load_index(AVFormatContext *s) ...@@ -1001,8 +1001,10 @@ static int avi_load_index(AVFormatContext *s)
ByteIOContext *pb = s->pb; ByteIOContext *pb = s->pb;
uint32_t tag, size; uint32_t tag, size;
int64_t pos= url_ftell(pb); int64_t pos= url_ftell(pb);
int ret = -1;
url_fseek(pb, avi->movi_end, SEEK_SET); if (url_fseek(pb, avi->movi_end, SEEK_SET) < 0)
goto the_end; // maybe truncated file
#ifdef DEBUG_SEEK #ifdef DEBUG_SEEK
printf("movi_end=0x%"PRIx64"\n", avi->movi_end); printf("movi_end=0x%"PRIx64"\n", avi->movi_end);
#endif #endif
...@@ -1023,19 +1025,20 @@ static int avi_load_index(AVFormatContext *s) ...@@ -1023,19 +1025,20 @@ static int avi_load_index(AVFormatContext *s)
case MKTAG('i', 'd', 'x', '1'): case MKTAG('i', 'd', 'x', '1'):
if (avi_read_idx1(s, size) < 0) if (avi_read_idx1(s, size) < 0)
goto skip; goto skip;
else ret = 0;
goto the_end; goto the_end;
break; break;
default: default:
skip: skip:
size += (size & 1); size += (size & 1);
url_fskip(pb, size); if (url_fseek(pb, size, SEEK_CUR) < 0)
goto the_end; // something is wrong here
break; break;
} }
} }
the_end: the_end:
url_fseek(pb, pos, SEEK_SET); url_fseek(pb, pos, SEEK_SET);
return 0; return ret;
} }
static int avi_read_seek(AVFormatContext *s, int stream_index, int64_t timestamp, int flags) static int avi_read_seek(AVFormatContext *s, int stream_index, int64_t timestamp, int flags)
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment