[FFmpeg-cvslog] avformat/rpl: Check for EOF and zero framesize

[Michael Niedermayer]

ffmpeg | branch: release/4.4 | Michael Niedermayer <michael at niedermayer.cc> | Thu Jun  3 22:46:05 2021 +0200| [57f68127da4f270967f67975e4e22e2ee36169f3] | committer: Michael Niedermayer

avformat/rpl: Check for EOF and zero framesize

Fixes: Infinite loop
Fixes: 34751/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-5439330800762880
Fixes: 34774/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-5851571660390400

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
(cherry picked from commit a0a4a527c3b0819368d9b148542bb7663f39df79)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=57f68127da4f270967f67975e4e22e2ee36169f3
---

 libavformat/rpl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/rpl.c b/libavformat/rpl.c
index 940794606c..c474b76c45 100644
--- a/libavformat/rpl.c
+++ b/libavformat/rpl.c
@@ -336,7 +336,7 @@ static int rpl_read_packet(AVFormatContext *s, AVPacket *pkt)
 
         avio_skip(pb, 4); /* flags */
         frame_size = avio_rl32(pb);
-        if (avio_seek(pb, -8, SEEK_CUR) < 0)
+        if (avio_feof(pb) || avio_seek(pb, -8, SEEK_CUR) < 0 || !frame_size)
             return AVERROR(EIO);
 
         ret = av_get_packet(pb, pkt, frame_size);