avformat/rl2: Fix DoS due to lack of eof check

Fixes: loop.rl2

Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 96f24d1bee)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
孙浩 and 张洪亮(望初) 2017-08-25 01:15:29 +02:00 committed by Michael Niedermayer
parent 983f90ef18
commit 2ac9bc3497
1 changed files with 12 additions and 3 deletions

View File

@ -170,12 +170,21 @@ static av_cold int rl2_read_header(AVFormatContext *s)
} }
/** read offset and size tables */ /** read offset and size tables */
for(i=0; i < frame_count;i++) for(i=0; i < frame_count;i++) {
if (avio_feof(pb))
return AVERROR_INVALIDDATA;
chunk_size[i] = avio_rl32(pb); chunk_size[i] = avio_rl32(pb);
for(i=0; i < frame_count;i++) }
for(i=0; i < frame_count;i++) {
if (avio_feof(pb))
return AVERROR_INVALIDDATA;
chunk_offset[i] = avio_rl32(pb); chunk_offset[i] = avio_rl32(pb);
for(i=0; i < frame_count;i++) }
for(i=0; i < frame_count;i++) {
if (avio_feof(pb))
return AVERROR_INVALIDDATA;
audio_size[i] = avio_rl32(pb) & 0xFFFF; audio_size[i] = avio_rl32(pb) & 0xFFFF;
}
/** build the sample index */ /** build the sample index */
for(i=0;i<frame_count;i++){ for(i=0;i<frame_count;i++){