Browse Source

lavc/movtextdec.c: Avoid infinite loop on invalid data.

Signed-off-by: Sasi Inguva <isasi@google.com>
(cherry picked from commit 7e9e1b7070)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
tags/n3.1.4
Sasi Inguva Michael Niedermayer 9 years ago
parent
commit
39dc26f0c1
1 changed files with 4 additions and 0 deletions
  1. +4
    -0
      libavcodec/movtextdec.c

+ 4
- 0
libavcodec/movtextdec.c View File

@@ -471,6 +471,10 @@ static int mov_text_decode_frame(AVCodecContext *avctx,
tsmb_type = AV_RB32(tsmb);
tsmb += 4;

if (tsmb_size == 0) {
return AVERROR_INVALIDDATA;
}

if (tsmb_size == 1) {
if (m->tracksize + 16 > avpkt->size)
break;


Loading…
Cancel
Save