asfdec: make sure packet_size is non-zero before seeking
authorAndreas Cadhalpun <andreas.cadhalpun@googlemail.com>
Thu, 7 Jan 2016 09:02:53 +0000 (10:02 +0100)
committerLuca Barbato <lu_zero@gentoo.org>
Sun, 7 Feb 2016 02:12:33 +0000 (03:12 +0100)
This fixes infinite loops due to seeking back.

Signed-off-by: Alexandra Hájková <alexandra@khirnov.net>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
libavformat/asfdec.c

index cbab9a2..85d3266 100644 (file)
@@ -1291,6 +1291,10 @@ static int asf_read_payload(AVFormatContext *s, AVPacket *pkt)
         }
         if (!asf_pkt) {
             if (asf->packet_offset + asf->packet_size <= asf->data_offset + asf->data_size) {
+                if (!asf->packet_size) {
+                    av_log(s, AV_LOG_ERROR, "Invalid packet size 0.\n");
+                    return AVERROR_INVALIDDATA;
+                }
                 avio_seek(pb, asf->packet_offset + asf->packet_size, SEEK_SET);
                 av_log(s, AV_LOG_WARNING, "Skipping the stream with the invalid stream index %d.\n",
                        asf->stream_index);