---
libavformat/asfdec.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/libavformat/asfdec.c b/libavformat/asfdec.c
index 467adec..a52ea0b 100644
--- a/libavformat/asfdec.c
+++ b/libavformat/asfdec.c
@@ -777,6 +777,8 @@ static int asf_read_stream_properties(AVFormatContext *s,
const GUIDParseTable *
asf_st->span = span;
asf_st->virtual_pkt_len = avio_rl16(pb);
asf_st->virtual_chunk_len = avio_rl16(pb);
+ if (!asf_st->virtual_chunk_len || !asf_st->virtual_pkt_len)
+ return AVERROR_INVALIDDATA;
avio_skip(pb, err_data_len - 5);
} else
avio_skip(pb, err_data_len - 1);
@@ -1425,6 +1427,7 @@ static int asf_read_packet(AVFormatContext *s, AVPacket
*pkt)
ASFPacket *asf_pkt = &asf->asf_st[i]->pkt;
if (asf_pkt && !asf_pkt->size_left && asf_pkt->data_size) {
if (asf->asf_st[i]->span > 1 &&
+ asf->asf_st[i]->virtual_pkt_len &&
asf->asf_st[i]->type == AVMEDIA_TYPE_AUDIO)
if ((ret = asf_deinterleave(s, asf_pkt, i)) < 0)
return ret;
--
2.0.1
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel
