Browse Source

asfdec: fix assert failure on invalid files

Add an extra size validity check in asf_read_frame_header(). Without
this asf->packet_size_left may become negative, which triggers an
assertion failure later.

Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
tags/n0.8
Uoti Urpala Ronald S. Bultje 14 years ago
parent
commit
0bd433a916
1 changed files with 4 additions and 0 deletions
  1. +4
    -0
      libavformat/asfdec.c

+ 4
- 0
libavformat/asfdec.c View File

@@ -864,6 +864,10 @@ static int asf_read_frame_header(AVFormatContext *s, AVIOContext *pb){
}
//printf("Fragsize %d\n", asf->packet_frag_size);
} else {
if (rsize > asf->packet_size_left) {
av_log(s, AV_LOG_ERROR, "packet_replic_size is invalid\n");
return -1;
}
asf->packet_frag_size = asf->packet_size_left - rsize;
//printf("Using rest %d %d %d\n", asf->packet_frag_size, asf->packet_size_left, rsize);
}


Loading…
Cancel
Save