Fixes Ticket3521
Unified · Split
| @@ -1062,7 +1062,7 @@ static int asf_read_frame_header(AVFormatContext *s, AVIOContext *pb) · 1061 unmodified lines | |||
| 1062 | int64_t end = avio_tell(pb) + asf->packet_replic_size; | 1062 | int64_t end = avio_tell(pb) + asf->packet_replic_size; |
| 1063 | AVRational aspect; | 1063 | AVRational aspect; |
| 1064 | asfst->packet_obj_size = avio_rl32(pb); | 1064 | asfst->packet_obj_size = avio_rl32(pb); |
| 1065 | if (asfst->packet_obj_size >= (1 << 24) || asfst->packet_obj_size <= 0) { | 1065 | if (asfst->packet_obj_size >= (1 << 24) || asfst->packet_obj_size < 0) { |
| 1066 | av_log(s, AV_LOG_ERROR, "packet_obj_size %d invalid\n", asfst->packet_obj_size); | 1066 | av_log(s, AV_LOG_ERROR, "packet_obj_size %d invalid\n", asfst->packet_obj_size); |
| 1067 | asfst->packet_obj_size = 0; | 1067 | asfst->packet_obj_size = 0; |
| 1068 | return AVERROR_INVALIDDATA; | 1068 | return AVERROR_INVALIDDATA; |