avformat/asfdec: Fix DoS due to lack of eof check

Fixes: loop.asf

孙浩 and 张洪亮(望初) committed 9 years ago

Commit 7f9ec551 parent 7ec41481 file · +4 −2Browse files

Unified · Split

libavformat/asfdec_f.c+4−2

@@ -749,13 +749,15 @@ static int asf_read_marker(AVFormatContext *s, int64_t size) · 748 unmodified lines
749	749	count = avio_rl32(pb); // markers count
750	750	avio_rl16(pb); // reserved 2 bytes
751	751	name_len = avio_rl16(pb); // name length
752		− for (i = 0; i < name_len; i++)
753		− avio_r8(pb); // skip the name
	752	+ avio_skip(pb, name_len);
754	753
755	754	for (i = 0; i < count; i++) {
756	755	int64_t pres_time;
757	756	int name_len;
758	757
	758	+ if (avio_feof(pb))
	759	+ return AVERROR_INVALIDDATA;
	760	+
759	761	avio_rl64(pb); // offset, 8 bytes
760	762	pres_time = avio_rl64(pb); // presentation time
761	763	pres_time -= asf->hdr.preroll * 10000;