From 9123950be0dbbfceacb38c0a9b09fdb01ae5b111 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tomas=20H=C3=A4rdin?= Date: Thu, 26 Jan 2012 13:21:41 +0100 Subject: [PATCH] mxfdec: Don't crash in mxf_packet_timestamps() if current_edit_unit overflows Signed-off-by: Diego Biurrun --- libavformat/mxfdec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c index 25d8c2b4c6..5043d4eee3 100644 --- a/libavformat/mxfdec.c +++ b/libavformat/mxfdec.c @@ -1798,7 +1798,7 @@ static void mxf_packet_timestamps(MXFContext *mxf, AVPacket *pkt) return; /* find mxf->current_edit_unit so that the next edit unit starts ahead of pkt->pos */ - for (;;) { + while (mxf->current_edit_unit >= 0) { if (mxf_edit_unit_absolute_offset(mxf, t, mxf->current_edit_unit + 1, NULL, &next_ofs, 0) < 0) break; @@ -1817,7 +1817,7 @@ static void mxf_packet_timestamps(MXFContext *mxf, AVPacket *pkt) mxf->current_edit_unit++; } - if (mxf->current_edit_unit >= t->nb_ptses) + if (mxf->current_edit_unit < 0 || mxf->current_edit_unit >= t->nb_ptses) return; pkt->dts = mxf->current_edit_unit + t->first_dts;