| 
																	
																	
																		
																	
																	
																 | 
																@@ -749,13 +749,15 @@ static int asf_read_marker(AVFormatContext *s, int64_t size) | 
															
														
														
													
														
															
																 | 
																 | 
																    count = avio_rl32(pb);    // markers count | 
																 | 
																 | 
																    count = avio_rl32(pb);    // markers count | 
															
														
														
													
														
															
																 | 
																 | 
																    avio_rl16(pb);            // reserved 2 bytes | 
																 | 
																 | 
																    avio_rl16(pb);            // reserved 2 bytes | 
															
														
														
													
														
															
																 | 
																 | 
																    name_len = avio_rl16(pb); // name length | 
																 | 
																 | 
																    name_len = avio_rl16(pb); // name length | 
															
														
														
													
														
															
																 | 
																 | 
																    for (i = 0; i < name_len; i++) | 
																 | 
																 | 
																 | 
															
														
														
													
														
															
																 | 
																 | 
																        avio_r8(pb); // skip the name | 
																 | 
																 | 
																 | 
															
														
														
													
														
															
																 | 
																 | 
																 | 
																 | 
																 | 
																    avio_skip(pb, name_len); | 
															
														
														
													
														
															
																 | 
																 | 
																
  | 
																 | 
																 | 
																
  | 
															
														
														
													
														
															
																 | 
																 | 
																    for (i = 0; i < count; i++) { | 
																 | 
																 | 
																    for (i = 0; i < count; i++) { | 
															
														
														
													
														
															
																 | 
																 | 
																        int64_t pres_time; | 
																 | 
																 | 
																        int64_t pres_time; | 
															
														
														
													
														
															
																 | 
																 | 
																        int name_len; | 
																 | 
																 | 
																        int name_len; | 
															
														
														
													
														
															
																 | 
																 | 
																
  | 
																 | 
																 | 
																
  | 
															
														
														
													
														
															
																 | 
																 | 
																 | 
																 | 
																 | 
																        if (avio_feof(pb)) | 
															
														
														
													
														
															
																 | 
																 | 
																 | 
																 | 
																 | 
																            return AVERROR_INVALIDDATA; | 
															
														
														
													
														
															
																 | 
																 | 
																 | 
																 | 
																 | 
																
  | 
															
														
														
													
														
															
																 | 
																 | 
																        avio_rl64(pb);             // offset, 8 bytes | 
																 | 
																 | 
																        avio_rl64(pb);             // offset, 8 bytes | 
															
														
														
													
														
															
																 | 
																 | 
																        pres_time = avio_rl64(pb); // presentation time | 
																 | 
																 | 
																        pres_time = avio_rl64(pb); // presentation time | 
															
														
														
													
														
															
																 | 
																 | 
																        pres_time -= asf->hdr.preroll * 10000; | 
																 | 
																 | 
																        pres_time -= asf->hdr.preroll * 10000; | 
															
														
														
													
												
													
														
															
																| 
																	
																		
																	
																	
																	
																 | 
																
  |