Fixes: loop.rl2
Unified · Split
| @@ -170,12 +170,21 @@ static av_cold int rl2_read_header(AVFormatContext *s) · 169 unmodified lines | ||
| 170 | 170 | } |
| 171 | 171 | |
| 172 | 172 | /** read offset and size tables */ |
| 173 | − for(i=0; i < frame_count;i++) | |
| 173 | + for(i=0; i < frame_count;i++) { | |
| 174 | + if (avio_feof(pb)) | |
| 175 | + return AVERROR_INVALIDDATA; | |
| 174 | 176 | chunk_size[i] = avio_rl32(pb); |
| 175 | − for(i=0; i < frame_count;i++) | |
| 177 | + } | |
| 178 | + for(i=0; i < frame_count;i++) { | |
| 179 | + if (avio_feof(pb)) | |
| 180 | + return AVERROR_INVALIDDATA; | |
| 176 | 181 | chunk_offset[i] = avio_rl32(pb); |
| 177 | − for(i=0; i < frame_count;i++) | |
| 182 | + } | |
| 183 | + for(i=0; i < frame_count;i++) { | |
| 184 | + if (avio_feof(pb)) | |
| 185 | + return AVERROR_INVALIDDATA; | |
| 178 | 186 | audio_size[i] = avio_rl32(pb) & 0xFFFF; |
| 187 | + } | |
| 179 | 188 | |
| 180 | 189 | /** build the sample index */ |
| 181 | 190 | for(i=0;i<frame_count;i++){ |