From 6665938ca8b7ad8b7ec77c23e611bb8224e88a90 Mon Sep 17 00:00:00 2001 From: Paul B Mahol Date: Sun, 12 Nov 2017 20:26:42 +0100 Subject: [PATCH] avformat/ty: check if header is correctly parsed and is still present Fixes #6829. Signed-off-by: Paul B Mahol --- libavformat/ty.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/libavformat/ty.c b/libavformat/ty.c index 02ab59aa2e..0f08e787f5 100644 --- a/libavformat/ty.c +++ b/libavformat/ty.c @@ -440,6 +440,8 @@ static int get_chunk(AVFormatContext *s) return AVERROR_INVALIDDATA; ty->rec_hdrs = parse_chunk_headers(ty->chunk + 4, num_recs); + if (!ty->rec_hdrs) + return AVERROR(ENOMEM); ty->cur_chunk_pos += 16 * num_recs; return 0; @@ -723,8 +725,8 @@ static int ty_read_packet(AVFormatContext *s, AVPacket *pkt) return AVERROR_EOF; while (ret <= 0) { - if (ty->first_chunk || ty->cur_rec >= ty->num_recs) { - if (get_chunk(s) < 0 || ty->num_recs == 0) + if (!ty->rec_hdrs || ty->first_chunk || ty->cur_rec >= ty->num_recs) { + if (get_chunk(s) < 0 || ty->num_recs <= 0) return AVERROR_EOF; }