[FFmpeg-cvslog] avformat/ty: check if header is correctly parsed and is still present

[Paul B Mahol]

ffmpeg | branch: master | Paul B Mahol <onemda at gmail.com> | Sun Nov 12 20:26:42 2017 +0100| [6665938ca8b7ad8b7ec77c23e611bb8224e88a90] | committer: Paul B Mahol

avformat/ty: check if header is correctly parsed and is still present

Fixes #6829.

Signed-off-by: Paul B Mahol <onemda at gmail.com>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=6665938ca8b7ad8b7ec77c23e611bb8224e88a90
---

 libavformat/ty.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/libavformat/ty.c b/libavformat/ty.c
index 02ab59aa2e..0f08e787f5 100644
--- a/libavformat/ty.c
+++ b/libavformat/ty.c
@@ -440,6 +440,8 @@ static int get_chunk(AVFormatContext *s)
         return AVERROR_INVALIDDATA;
 
     ty->rec_hdrs = parse_chunk_headers(ty->chunk + 4, num_recs);
+    if (!ty->rec_hdrs)
+        return AVERROR(ENOMEM);
     ty->cur_chunk_pos += 16 * num_recs;
 
     return 0;
@@ -723,8 +725,8 @@ static int ty_read_packet(AVFormatContext *s, AVPacket *pkt)
         return AVERROR_EOF;
 
     while (ret <= 0) {
-        if (ty->first_chunk || ty->cur_rec >= ty->num_recs) {
-            if (get_chunk(s) < 0 || ty->num_recs == 0)
+        if (!ty->rec_hdrs || ty->first_chunk || ty->cur_rec >= ty->num_recs) {
+            if (get_chunk(s) < 0 || ty->num_recs <= 0)
                 return AVERROR_EOF;
         }