RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2024-12-25 08:42:39 +00:00
Code Issues Projects Releases Wiki Activity

Return an error when the parsed mpc chunk size is negative, otherwise we

Browse Source 
might end up in an endless loop where the same chunk is parsed over and over.
Fixes a hang near the end for http://samples.mplayerhq.hu/A-codecs/musepack/sv8/sv8-tags.mpc

Originally committed as revision 20099 to svn://svn.ffmpeg.org/ffmpeg/trunk
This commit is contained in:
Reimar Döffinger 2009-09-30 13:35:13 +00:00
parent 58f873dded
commit 5dd76bd741
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libavformat/mpc8.c
View File

@ -250,6 +250,8 @@ static int mpc8_read_packet(AVFormatContext *s, AVPacket *pkt)
while(!url_feof(s->pb)){ while(!url_feof(s->pb)){
pos = url_ftell(s->pb); pos = url_ftell(s->pb);
mpc8_get_chunk_header(s->pb, &tag, &size); mpc8_get_chunk_header(s->pb, &tag, &size);
if (size < 0)
return -1;
if(tag == TAG_AUDIOPACKET){ if(tag == TAG_AUDIOPACKET){
if(av_get_packet(s->pb, pkt, size) < 0) if(av_get_packet(s->pb, pkt, size) < 0)
return AVERROR(ENOMEM); return AVERROR(ENOMEM);