Commit cd7a2e15 authored by John Stebbins's avatar John Stebbins

asfdec: fix reading files larger than 2GB

avio_skip returns file position and overflows int
parent 248dc5c1
...@@ -976,7 +976,8 @@ static int asf_read_simple_index(AVFormatContext *s, const GUIDParseTable *g) ...@@ -976,7 +976,8 @@ static int asf_read_simple_index(AVFormatContext *s, const GUIDParseTable *g)
uint64_t interval; // index entry time interval in 100 ns units, usually it's 1s uint64_t interval; // index entry time interval in 100 ns units, usually it's 1s
uint32_t pkt_num, nb_entries; uint32_t pkt_num, nb_entries;
int32_t prev_pkt_num = -1; int32_t prev_pkt_num = -1;
int i, ret; int i;
int64_t offset;
uint64_t size = avio_rl64(pb); uint64_t size = avio_rl64(pb);
// simple index objects should be ordered by stream number, this loop tries to find // simple index objects should be ordered by stream number, this loop tries to find
...@@ -998,10 +999,10 @@ static int asf_read_simple_index(AVFormatContext *s, const GUIDParseTable *g) ...@@ -998,10 +999,10 @@ static int asf_read_simple_index(AVFormatContext *s, const GUIDParseTable *g)
nb_entries = avio_rl32(pb); nb_entries = avio_rl32(pb);
for (i = 0; i < nb_entries; i++) { for (i = 0; i < nb_entries; i++) {
pkt_num = avio_rl32(pb); pkt_num = avio_rl32(pb);
ret = avio_skip(pb, 2); offset = avio_skip(pb, 2);
if (ret < 0) { if (offset < 0) {
av_log(s, AV_LOG_ERROR, "Skipping failed in asf_read_simple_index.\n"); av_log(s, AV_LOG_ERROR, "Skipping failed in asf_read_simple_index.\n");
return ret; return offset;
} }
if (prev_pkt_num != pkt_num) { if (prev_pkt_num != pkt_num) {
av_add_index_entry(st, asf->first_packet_offset + asf->packet_size * av_add_index_entry(st, asf->first_packet_offset + asf->packet_size *
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment