[FFmpeg-cvslog] asfdec: do not skip padding if offset is above packet size - padding

[Alexandra Hájková]

ffmpeg | branch: master | Alexandra Hájková <alexandra.khirnova at gmail.com> | Tue Jul 28 10:17:16 2015 +0200| [00cc10aee380f882507bac994ac469d8358d12e8] | committer: Luca Barbato

asfdec: do not skip padding if offset is above packet size - padding

Sample-Id: https://samples.libav.org/asf-wmv/demux-asf-assert-failed.wmv

Signed-off-by: Luca Barbato <lu_zero at gentoo.org>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=00cc10aee380f882507bac994ac469d8358d12e8
---

 libavformat/asfdec.c |    9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/libavformat/asfdec.c b/libavformat/asfdec.c
index c78a9de..a39f6d4 100644
--- a/libavformat/asfdec.c
+++ b/libavformat/asfdec.c
@@ -1428,7 +1428,9 @@ static int asf_read_packet(AVFormatContext *s, AVPacket *pkt)
         case READ_MULTI_SUB:
             if (!asf->sub_left && !asf->nb_mult_left) {
                 asf->state = PARSE_PACKET_HEADER;
-                if (!asf->return_subpayload)
+                if (!asf->return_subpayload &&
+                    (avio_tell(pb) <= asf->packet_offset +
+                     asf->packet_size - asf->pad_len))
                     avio_skip(pb, asf->pad_len); // skip padding
                 if (asf->packet_offset + asf->packet_size > avio_tell(pb))
                     avio_seek(pb, asf->packet_offset + asf->packet_size, SEEK_SET);
@@ -1438,9 +1440,10 @@ static int asf_read_packet(AVFormatContext *s, AVPacket *pkt)
         case READ_MULTI:
             if (!asf->nb_mult_left) {
                 asf->state = PARSE_PACKET_HEADER;
-                if (!asf->return_subpayload) {
+                if (!asf->return_subpayload &&
+                    (avio_tell(pb) <= asf->packet_offset +
+                     asf->packet_size - asf->pad_len))
                     avio_skip(pb, asf->pad_len); // skip padding
-                }
                 if (asf->packet_offset + asf->packet_size > avio_tell(pb))
                     avio_seek(pb, asf->packet_offset + asf->packet_size, SEEK_SET);
             }