[FFmpeg-cvslog] r19332 - trunk/libavformat/avidec.c

[reimar]

Author: reimar
Date: Fri Jul  3 13:26:14 2009
New Revision: 19332

Log:
Check size of "strf" header against size of enclosing "LIST" if there is one.

Modified:
   trunk/libavformat/avidec.c

Modified: trunk/libavformat/avidec.c
==============================================================================
--- trunk/libavformat/avidec.c	Fri Jul  3 13:18:56 2009	(r19331)
+++ trunk/libavformat/avidec.c	Fri Jul  3 13:26:14 2009	(r19332)
@@ -252,6 +252,7 @@ static int avi_read_header(AVFormatConte
     AVIStream *ast = NULL;
     int avih_width=0, avih_height=0;
     int amv_file_format=0;
+    uint64_t list_end = 0;
 
     avi->stream_index= -1;
 
@@ -277,6 +278,7 @@ static int avi_read_header(AVFormatConte
 
         switch(tag) {
         case MKTAG('L', 'I', 'S', 'T'):
+            list_end = url_ftell(pb) + size;
             /* Ignored, except at start of video packets. */
             tag1 = get_le32(pb);
 #ifdef DEBUG
@@ -445,6 +447,9 @@ static int avi_read_header(AVFormatConte
             if (stream_index >= (unsigned)s->nb_streams || avi->dv_demux) {
                 url_fskip(pb, size);
             } else {
+                uint64_t cur_pos = url_ftell(pb);
+                if (cur_pos < list_end)
+                    size = FFMIN(size, list_end - cur_pos);
                 st = s->streams[stream_index];
                 switch(codec_type) {
                 case CODEC_TYPE_VIDEO: