mov: abort on EOF in ff_mov_read_chan
authorAndreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Tue, 26 May 2015 13:24:35 +0000 (14:24 +0100)
committerLuca Barbato <lu_zero@gentoo.org>
Sun, 31 May 2015 11:05:12 +0000 (13:05 +0200)
Otherwise the loop can take a lot of time if num_descr is very large.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
libavformat/mov_chan.c

index 2c54920..94b93cf 100644 (file)
@@ -565,6 +565,11 @@ int ff_mov_read_chan(AVFormatContext *s, AVIOContext *pb, AVStream *st,
     label_mask = 0;
     for (i = 0; i < num_descr; i++) {
         uint32_t label;
+        if (pb->eof_reached) {
+            av_log(s, AV_LOG_ERROR,
+                   "reached EOF while reading channel layout\n");
+            return AVERROR_INVALIDDATA;
+        }
         label     = avio_rb32(pb);          // mChannelLabel
         avio_rb32(pb);                      // mChannelFlags
         avio_rl32(pb);                      // mCoordinates[0]