Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Browse files

riff: fix infinite loop

Fixes Ticket2241

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
  • Loading branch information...
commit a8343bfb6a3f00777943b94ff2969422f578f246 1 parent 2b20397
@michaelni michaelni authored
Showing with 7 additions and 1 deletion.
  1. +7 −1 libavformat/riff.c
View
8 libavformat/riff.c
@@ -818,7 +818,13 @@ int ff_read_riff_info(AVFormatContext *s, int64_t size)
chunk_code = avio_rl32(pb);
chunk_size = avio_rl32(pb);
-
+ if (url_feof(pb)) {
+ if (chunk_code || chunk_size) {
+ av_log(s, AV_LOG_WARNING, "INFO subchunk truncated\n");
+ return AVERROR_INVALIDDATA;
+ }
+ break;
+ }
if (chunk_size > end || end - chunk_size < cur || chunk_size == UINT_MAX) {
avio_seek(pb, -9, SEEK_CUR);
chunk_code = avio_rl32(pb);
Please sign in to comment.
Something went wrong with that request. Please try again.