avformat/img2dec: fix infinite loop
authorMichael Niedermayer <michael@niedermayer.cc>
Sat, 10 Mar 2018 00:40:36 +0000 (01:40 +0100)
committerMichael Niedermayer <michael@niedermayer.cc>
Sat, 10 Mar 2018 01:44:45 +0000 (02:44 +0100)
Fixes: kira-poc

Found-by: Kira <kira_cxy@foxmail.com>
Change suggested by Kira
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavformat/img2dec.c

index 62db0d9..f3f52c8 100644 (file)
@@ -878,10 +878,14 @@ static int svg_probe(AVProbeData *p)
 {
     const uint8_t *b = p->buf;
     const uint8_t *end = p->buf + p->buf_size;
+
     if (memcmp(p->buf, "<?xml", 5))
         return 0;
     while (b < end) {
-        b += ff_subtitles_next_line(b);
+        int inc = ff_subtitles_next_line(b);
+        if (!inc)
+            break;
+        b += inc;
         if (b >= end - 4)
             return 0;
         if (!memcmp(b, "<svg", 4))