[FFmpeg-cvslog] mov: abort on EOF in ff_mov_read_chan

Andreas Cadhalpun git at videolan.org
Thu Aug 20 14:53:40 CEST 2015


ffmpeg | branch: release/2.4 | Andreas Cadhalpun <Andreas.Cadhalpun at googlemail.com> | Sat May 23 23:32:12 2015 +0200| [cd83ff5d4c7036e1f95aecac502e9b7e66a77c81] | committer: Michael Niedermayer

mov: abort on EOF in ff_mov_read_chan

Otherwise the loop can take a lot of time if num_descr is very large.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun at googlemail.com>
(cherry picked from commit a5718863da99b54b6c853d45c84871c4a96a57c0)

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=cd83ff5d4c7036e1f95aecac502e9b7e66a77c81
---

 libavformat/mov_chan.c |    5 +++++
 1 file changed, 5 insertions(+)

diff --git a/libavformat/mov_chan.c b/libavformat/mov_chan.c
index 3b91ed7..b63310b 100644
--- a/libavformat/mov_chan.c
+++ b/libavformat/mov_chan.c
@@ -566,6 +566,11 @@ int ff_mov_read_chan(AVFormatContext *s, AVIOContext *pb, AVStream *st,
     label_mask = 0;
     for (i = 0; i < num_descr; i++) {
         uint32_t label;
+        if (pb->eof_reached) {
+            av_log(s, AV_LOG_ERROR,
+                   "reached EOF while reading channel layout\n");
+            return AVERROR_INVALIDDATA;
+        }
         label     = avio_rb32(pb);          // mChannelLabel
         avio_rb32(pb);                      // mChannelFlags
         avio_rl32(pb);                      // mCoordinates[0]



More information about the ffmpeg-cvslog mailing list