Commit c29e87ad authored by Andreas Cadhalpun's avatar Andreas Cadhalpun

asfdec_o: check for too small size in asf_read_unknown

This fixes infinite loops due to seeking back.
Reviewed-by: 's avatarAlexandra Hájková <alexandra.khirnova@gmail.com>
Signed-off-by: 's avatarAndreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
parent 0e32153e
......@@ -190,8 +190,13 @@ static int asf_read_unknown(AVFormatContext *s, const GUIDParseTable *g)
if ((ret = detect_unknown_subobject(s, asf->unknown_offset,
asf->unknown_size)) < 0)
return ret;
} else
} else {
if (size < 24) {
av_log(s, AV_LOG_ERROR, "Too small size %"PRIu64" (< 24).\n", size);
return AVERROR_INVALIDDATA;
}
avio_skip(pb, size - 24);
}
return 0;
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment