From: Andreas Cadhalpun <[email protected]> Both avio_skip and detect_unknown_subobject use int64_t for the size parameter.
This fixes a segmentation fault due to infinite recursion. Signed-off-by: Andreas Cadhalpun <[email protected]> --- Rebased patch. libavformat/asfdec.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavformat/asfdec.c b/libavformat/asfdec.c index 5c39878..dd69754 100644 --- a/libavformat/asfdec.c +++ b/libavformat/asfdec.c @@ -178,6 +178,9 @@ static int asf_read_unknown(AVFormatContext *s, const GUIDParseTable *g) uint64_t size = avio_rl64(pb); int ret; + if (size > INT64_MAX) + return AVERROR_INVALIDDATA; + if (asf->is_header) asf->unknown_size = size; asf->is_header = 0; -- 2.1.4 _______________________________________________ libav-devel mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-devel
