From c2e2b3029e7f6d81dc2e0dae82b92f05c03c376b Mon Sep 17 00:00:00 2001 From: Paul B Mahol Date: Fri, 26 Oct 2012 14:01:51 +0000 Subject: [PATCH] cafdec: fix parsing of chunks which may have unused data Specification mentions 'strg', 'mark', 'regn', 'info', .. chunks to have data section size larger than chunk's current meaningful content in order to reserve room for additional data. Signed-off-by: Paul B Mahol --- libavformat/cafdec.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/libavformat/cafdec.c b/libavformat/cafdec.c index a576dac07e..f166804795 100644 --- a/libavformat/cafdec.c +++ b/libavformat/cafdec.c @@ -225,7 +225,7 @@ static int read_header(AVFormatContext *s) AVStream *st; uint32_t tag = 0; int found_data, ret; - int64_t size; + int64_t size, pos; avio_skip(pb, 8); /* magic, version, file flags */ @@ -254,6 +254,7 @@ static int read_header(AVFormatContext *s) tag = avio_rb32(pb); size = avio_rb64(pb); + pos = avio_tell(pb); if (url_feof(pb)) break; @@ -296,9 +297,14 @@ static int read_header(AVFormatContext *s) case MKBETAG('f','r','e','e'): if (size < 0) return AVERROR_INVALIDDATA; - avio_skip(pb, size); break; } + + if (size > 0) { + if (pos + size < pos) + return AVERROR_INVALIDDATA; + avio_skip(pb, FFMAX(0, pos + size - avio_tell(pb))); + } } if (!found_data)