dvdsubdec: reset buffer size on invalid over-large packets
authorwm4 <nfxjfg@googlemail.com>
Thu, 28 May 2015 12:30:14 +0000 (14:30 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Thu, 28 May 2015 13:31:07 +0000 (15:31 +0200)
Otherwise it will never be reset, and remain "stuck" in this state
forever. Can happen when seeking: the decoder will receive fragments
from different file positions, which triggers the condition easily.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/dvdsubdec.c

index 673fc60..a87a3bc 100644 (file)
@@ -519,6 +519,7 @@ static int append_to_cached_buf(AVCodecContext *avctx,
     if (ctx->buf_size >= sizeof(ctx->buf) - buf_size) {
         av_log(avctx, AV_LOG_WARNING, "Attempt to reconstruct "
                "too large SPU packets aborted.\n");
+        ctx->buf_size = 0;
         return AVERROR_INVALIDDATA;
     }
     memcpy(ctx->buf + ctx->buf_size, buf, buf_size);