RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avformat/avidec: Fix infinite loop in avi_read_nikon() 

Fixes: 360/test.poc

Found-by: 连一汉 <lianyihan@360.cn>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2016-09-02 12:19:29 +02:00
parent 367577dbe2
commit e4e4a9cad7
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libavformat/avidec.c
View File

@ -344,14 +344,14 @@ static void avi_metadata_creation_time(AVDictionary **metadata, char *date)
static void avi_read_nikon(AVFormatContext *s, uint64_t end) static void avi_read_nikon(AVFormatContext *s, uint64_t end)
{ {
while (avio_tell(s->pb) < end) { while (avio_tell(s->pb) < end && !avio_feof(s->pb)) {
uint32_t tag = avio_rl32(s->pb); uint32_t tag = avio_rl32(s->pb);
uint32_t size = avio_rl32(s->pb); uint32_t size = avio_rl32(s->pb);
switch (tag) { switch (tag) {
case MKTAG('n', 'c', 't', 'g'): /* Nikon Tags */ case MKTAG('n', 'c', 't', 'g'): /* Nikon Tags */
{ {
uint64_t tag_end = avio_tell(s->pb) + size; uint64_t tag_end = avio_tell(s->pb) + size;
while (avio_tell(s->pb) < tag_end) { while (avio_tell(s->pb) < tag_end && !avio_feof(s->pb)) {
uint16_t tag = avio_rl16(s->pb); uint16_t tag = avio_rl16(s->pb);
uint16_t size = avio_rl16(s->pb); uint16_t size = avio_rl16(s->pb);
const char *name = NULL; const char *name = NULL;