The signature check would segfault in case the packet could not be allocated or if nothing could be read. Furthermore, read_packet callbacks are supposed to return zero on success, yet the current code returned the size of the packet.
Unified · Split
| @@ -225,7 +225,9 @@ static int apv_read_packet(AVFormatContext *s, AVPacket *pkt) · 224 unmodified lines | |||
| 225 | } | 225 | } |
| 226 | 226 | ||
| 227 | ret = av_get_packet(s->pb, pkt, au_size); | 227 | ret = av_get_packet(s->pb, pkt, au_size); |
| 228 | pkt->flags = AV_PKT_FLAG_KEY; | 228 | if (ret < 0) |
| 229 | return ret; | ||
| 230 | pkt->flags = AV_PKT_FLAG_KEY; | ||
| 229 | 231 | ||
| 230 | signature = AV_RB32(pkt->data); | 232 | signature = AV_RB32(pkt->data); |
| 231 | if (signature != APV_SIGNATURE) { | 233 | if (signature != APV_SIGNATURE) { |
| @@ -233,7 +235,7 @@ static int apv_read_packet(AVFormatContext *s, AVPacket *pkt) · 1 unmodified line | |||
| 233 | return AVERROR_INVALIDDATA; | 235 | return AVERROR_INVALIDDATA; |
| 234 | } | 236 | } |
| 235 | 237 | ||
| 236 | return ret; | 238 | return 0; |
| 237 | } | 239 | } |
| 238 | 240 | ||
| 239 | const FFInputFormat ff_apv_demuxer = { | 241 | const FFInputFormat ff_apv_demuxer = { |