The signature check would segfault in case the packet could not be allocated or if nothing could be read. Furthermore, read_packet callbacks are supposed to return zero on success, yet the current code returned the size of the packet.
Unified · Split
| @@ -225,7 +225,9 @@ static int apv_read_packet(AVFormatContext *s, AVPacket *pkt) · 224 unmodified lines | ||
| 225 | 225 | } |
| 226 | 226 | |
| 227 | 227 | ret = av_get_packet(s->pb, pkt, au_size); |
| 228 | − pkt->flags = AV_PKT_FLAG_KEY; | |
| 228 | + if (ret < 0) | |
| 229 | + return ret; | |
| 230 | + pkt->flags = AV_PKT_FLAG_KEY; | |
| 229 | 231 | |
| 230 | 232 | signature = AV_RB32(pkt->data); |
| 231 | 233 | if (signature != APV_SIGNATURE) { |
| @@ -233,7 +235,7 @@ static int apv_read_packet(AVFormatContext *s, AVPacket *pkt) · 1 unmodified line | ||
| 233 | 235 | return AVERROR_INVALIDDATA; |
| 234 | 236 | } |
| 235 | 237 | |
| 236 | − return ret; | |
| 238 | + return 0; | |
| 237 | 239 | } |
| 238 | 240 | |
| 239 | 241 | const FFInputFormat ff_apv_demuxer = { |