On 28/07/15 10:17, Alexandra Hájková wrote: > Sample-Id: https://samples.libav.org/asf-wmv/demux-asf-assert-failed.wmv > --- > libavformat/asfdec.c | 9 ++++++--- > 1 file changed, 6 insertions(+), 3 deletions(-) > > diff --git a/libavformat/asfdec.c b/libavformat/asfdec.c > index 3f039f1..69c9ecb 100644 > --- a/libavformat/asfdec.c > +++ b/libavformat/asfdec.c > @@ -1402,7 +1402,9 @@ static int asf_read_packet(AVFormatContext *s, AVPacket > *pkt) > case READ_MULTI_SUB: > if (!asf->sub_left && !asf->nb_mult_left) { > asf->state = PARSE_PACKET_HEADER; > - if (!asf->return_subpayload) > + if (!asf->return_subpayload && > + (avio_tell(pb) <= asf->packet_offset + > + asf->packet_size - asf->pad_len)) > avio_skip(pb, asf->pad_len); // skip padding > if (asf->packet_offset + asf->packet_size > avio_tell(pb)) > avio_seek(pb, asf->packet_offset + asf->packet_size, > SEEK_SET); > @@ -1412,9 +1414,10 @@ static int asf_read_packet(AVFormatContext *s, > AVPacket *pkt) > case READ_MULTI: > if (!asf->nb_mult_left) { > asf->state = PARSE_PACKET_HEADER; > - if (!asf->return_subpayload) { > + if (!asf->return_subpayload && > + (avio_tell(pb) <= asf->packet_offset + > + asf->packet_size - asf->pad_len)) > avio_skip(pb, asf->pad_len); // skip padding > - } > if (asf->packet_offset + asf->packet_size > avio_tell(pb)) > avio_seek(pb, asf->packet_offset + asf->packet_size, > SEEK_SET); > } >
Does it happen because the pad_len is somehow bogus? Might be nice to factorize those checks in a single place thought. lu lu _______________________________________________ libav-devel mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-devel
