avformat/ty: check cur_chunk_pos before using it
authorPaul B Mahol <onemda@gmail.com>
Sun, 12 Nov 2017 21:57:06 +0000 (22:57 +0100)
committerPaul B Mahol <onemda@gmail.com>
Sun, 12 Nov 2017 21:58:15 +0000 (22:58 +0100)
Fixes #6831.

Signed-off-by: Paul B Mahol <onemda@gmail.com>
libavformat/ty.c

index ba87428..d348643 100644 (file)
@@ -378,6 +378,8 @@ static void parse_master(AVFormatContext *s)
 
     ty->cur_chunk_pos = 32;
     for (j = 0; j < ty->seq_table_size; j++) {
+        if (ty->cur_chunk_pos >= CHUNK_SIZE - 8)
+            return;
         ty->seq_table[j].timestamp = AV_RB64(ty->chunk + ty->cur_chunk_pos);
         ty->cur_chunk_pos += 8;
         if (map_size > 8) {