avformat/hnm: check chunk_size == 0
authorMichael Niedermayer <michaelni@gmx.at>
Fri, 22 Nov 2013 22:44:57 +0000 (23:44 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Fri, 22 Nov 2013 22:52:08 +0000 (23:52 +0100)
Fixes potential infinite loop

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavformat/hnm.c

index e315414..47a1808 100644 (file)
@@ -148,7 +148,7 @@ static int hnm_read_packet(AVFormatContext *s, AVPacket *pkt)
     chunk_id = avio_rl16(pb);
     avio_skip(pb, 2);
 
-    if (chunk_size > hnm->superchunk_remaining) {
+    if (chunk_size > hnm->superchunk_remaining || !chunk_size) {
         av_log(s, AV_LOG_ERROR, "invalid chunk size: %u, offset: %u\n",
                chunk_size, (int) avio_tell(pb));
         avio_skip(pb, hnm->superchunk_remaining - 8);